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Using this Manual 



This manual will show you how to use HP 64768 emulators with the 
Terminal Interface. 

This manual will: 

■ Show you how to use emulation commands by executing them 
on a sample program and describing their results. 

■ Show you how to configure the emulator for your 
development needs. Topics include: restricting the emulator 
to real-time execution, selecting a target system clock source, 
and allowing the target system to insert wait states. 

■ Show you how to use the emulator in-circuit (connected to a 
target system). 

■ Describe the command syntax which is specific to the 64768 
emulator. 

This manual will not: 

■ Describe every available option to the emulation commands; 
this is done in the HP 64700 Emulators Terminal Interface: 
User's Reference. 

For the most part, the HP 647680A and HP 64768B emulators all 
operate the same way. Differences of between the emulators are 
described where they exist. Both the HP 64768A and HP 64768B 
emulators will be referred to as the "HP 64768 emulator" or "70433 
emulator". 



Organization 

Chapter 1 



Introduction to the 64768 Emulator. This chapter briefly introduces 
you to the concept of emulation and lists the basic features of the 64768 
emulator. 



Chapter 2 



Chapter 3 



Chapter 4 



Appendix A 



Appendix B 



Getting Started. This chapter shows you how to use emulation 
commands by executing them on a sample program. This chapter 
describes the sample program and how to: load programs into the 
emulator, map memory, display and modify memory, display registers, 
step through programs, run programs, use software breakpoints, search 
memory for data, and perform coverage tests on emulation memory. 

Emulation Topics. This chapter shows you how to: restrict the 
emulator to real-time execution, use the analyzer trigger to cause 
breaks, and run the emulator from target system reset. 

In-Circuit Emulation Topics. This chapter shows you how to: install 
the emulator probe into a target system, select a target system clock 
source, allow the target system to insert wait states, and use the features 
which allow you to debug target system ROM. 

64768 Emulator Specific Command Syntax. This appendix describes 
the command syntax which is specific to the 64768 emulator. Included 
are: emulator configuration items, address syntax, display and access 
modes. 



Using the Optional Foreground Monitor. This appendix describes how 
to use the foreground monitor. 
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Introduction to the 64768 Emulator 

Introduction The topics in this chapter include: 

■ Purpose of the emulator 

■ Features of the emulator 

■ Limitations and Restrictions of the emulator 



Purpose of the The 64768 emulator is designed to replace the 70433 microprocessor in 

Emulator ^ OUr tar S et s y stem to ner P y° u debug/integrate target system software 

*** and hardware. The emulator performs just like the processor which it 

replaces, but at the same time, it gives you information about the bus 
cycle operation of the processor. The emulator gives you control over 
target system execution and allows you to view or modify the contents 
of processor registers, target system memory, and I/O resources. 
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Figure 1-1 HP 64768 Emulator for uPD70433 
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Features of the HP 
64768 Emulator 



This section introduces you to the features of the emulator. The 
chapters which follow show you how to use these features. 



Supported 
Microprocessors 



The 132-pin PGA type of 70433 microprocessor is supported.The HP 
64768 emulator probe has a 132-pin PGA connector .When you use 
120-pin QFP type microprocessor, you must use with PGA to QFP 
adapter; refer to the "In-Circuit Emulation Topics "chapter in this 
manual. 



ClOCk Speeds The HP 64768A emulator runs with an internal clock speed of 

12.5MHz (system clock), or with target system clocks from 4 to 25 
MHz. 

The HP 64768B emulator runs with an internal clock speed of 
12.5MHz (system clock), or with target system clocks from 4 to 32 
MHz. 



Emulation memory The HP 64768 emulator is used with one of the following Emulation 

Memory Cards. 

■ HP 64726 128K byte Emulation Memory Card 

■ HP 64727 512Kbyte Emulation Memory Card 

■ HP 64728 1M byte Emulation Memory Card 

You can define up to 16 memory ranges (at 256 byte boundaries and at 
least 256 byte in length). The monitor occupies 2K bytes leaving 
126K,510K,1022K bytes of emulation memory which you may 
use. You can characterize memory ranges as emulation RAM, 
emulation ROM, target system RAM, target system ROM, or guarded 
memory. The emulator generates an error message when accesses are 
made to guarded memory locations. You can also configure the 
emulator so that writes to memory defined as ROM cause emulator 
execution to break out of target program execution. 
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Analysis 



Registers 
Single-Step 

Breakpoints 



The HP 64768 emulator is used with one of the following analyzers 
which allows you to trace code execution and processor activity. 

■ HP 64704 80-channel Emulation Bus Analyzer 

■ HP 64703 64-channel Emulation Bus Analyzer and 
16-channel State/Timing Analyzer 

The Emulation Bus Analyzer monitors the emulation processor using 
an internal analysis bus. The HP 64703 64-channel Emulation Bus 
Analyzer and 16-channel State/Timing Analyzer allows you to probe 
up to 16 different lines in your target system. 

You can display or modify the 70433 internal register contents. 



You can direct the emulation processor to execute a single instruction 
or a specified number of instructions. 

You can set up the emulator/analyzer interaction so that when the 
analyzer finds a specific state, emulator execution will break to the 
emulation monitor. 

You can also define software breakpoints in your program. The 
emulator uses the 70433 BRK 3 instruction to provide software 
breakpoint. When you define a software breakpoint, the emulator 
places a BRK 3 instruction at the specified address; after the BRK 3 
instruction causes emulator execution to break out of your program, the 
emulator replaces BRK 3 with the original opcode. 



Reset Support 



The emulator can be reset from the emulation system under your 
control, or your target system can reset the emulation processor. 



Configurable Target 
System Interface 



You can configure the emulator so that it honors target system wait 
requests when accessing emulation memory. 



Foreground or 
Background 
Emulation Monitor 



The emulation monitor is a program that is executed by the emulation 
processor. It allows the emulation controller to access target system 
resources. For example, when you display target system memory, it is 
the monitor program that executes 70433 instructions which read the 
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target memory locations and send their contents to the emulation 
controller. 

The monitor program can execute in foreground, the mode in which the 
emulator operates as would the target processor. The foreground 
monitor occupies processor address space and executes as if it were 
part of the target program. 

The monitor program can also execute in background. User program 
execution is suspended so that emulation processor can be used to 
access target system resources. The background monitor does not 
occupy any processor address space. 



Real-Time Operation Real-time operation signifies continuous execution of your program 

without interference from the emulator. (Such interference occurs when 
the emulator temporarily breaks to the monitor so that it can access 
register contents or target system memory or I/O.) 

You can restrict the emulator to real-time execution. When the 
emulator is executing your program under the real-time restriction, 
commands which display /modify registers, display/modify target 
system memory or I/O, or single-step are not allowed. 



Easy Products 
Upgrades 



Because the HP 64700 Series development tools (emulator, analyzer, 
LAN board) contain programmable parts, it is possible to reprogram 
the firmware and some of the hardware without disassembling the HP 
64700A Card Cage. This means that you'll be able to update product 
firmware, if desired, without having to call an HP field representative 
to your site. 
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Limitations, 
Restrictions 



Reset, Hold Request If you use background monitor, RESET and HLDRQ from target 
While in Background system are ignored while in monitor. 

Monitor 



User Interrupts While 
in Background 
Monitor 



If you use the background monitor, NMI and INTPO-5 from target 
system are suspended until the emulator goes into foreground 
operation. Other interrupts are ignored. 



Interrupts While 
Executing Step 
Command 



While stepping user program with the foreground monitor used, 
interrupts are accepted if they are enabled in the foreground monitor 
program. 



While stepping user program with the background monitor used, 
interrupts are ignored. 



Note 




You should not use step command in case the interrupt handler's 
punctuality is critical. 



Unbreaking intO the The emulator can not break into the monitor if the microprocessor is in 
Monitor n °kl state. The emulator will break into the monitor after hold state 
because break request is suspended. 

The emulator can not break into the monitor if the microprocessor is in 
reset state by RESET signal from target system. 

CLKOUT enable bit CLKOUT signal can be enabled/disabled by ENCLK bit, which is bit 5 

of PRC register. You must not clear ENCLK bit(ENCLK bit is " 1 " in 
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DMA Support 
Accessing SFR 

Accessing Reserved 
Area of I/O Space 

Evaluation Chip 



reset). The emulator will not work properly if CLKOUT signal is 
disabled 

Direct memory access to emulation memory by external DMA 
controller is not permitted. 

When you access SFR(Special Function Registers), you must use reg 
commands. If you access SFR with m commands, you will access to 
the actual memory you mapped(as target system ROM or RAM, 
emulation ROM or RAM). 

When you access reserved area of I/O space(0FF80h-0FFFFh) with 
"io" commands in the background monitor, the emulator operates 
exceptionally. When you display reserved area of I/O space, 
theemulator displays "FFh" . When you modify reserved area of 
I/Ospace, the emulator does not modify value. 

Hewlett-Packard makes no warranty of the problem caused by the 
Evaluation chip in the emulator. 
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Notes 
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Getting Started 



Introduction This chapter will lead you through a basic, step by step tutorial that 

shows how to use the HP 64768 emulator for the 70433 microprocessor. 

This chapter will: 

■ Describe the sample program used for this chapter's examples. 

■ Show you how to use the "help" facility. 

■ Show you how to use the memory mapper. 

■ Show you how to enter emulation commands to view 
execution of the sample program. The commands described in 
this chapter include: 

- Displaying and modifying memory 

- Stepping 

- Displaying registers 

- Defining macros 

- Searching memory 

- Running 

- Breaking 

- Using software breakpoints 

- Copying memory 

- Testing coverage 
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Before You Begin Before be ginning the tutorial presented in this chapter, you must have 

completed the following tasks: 

1 . Completed hardware installation of the HP 64700 emulator in 
the configuration you intend to use for your work: 

- Standalone configuration 

- Transparent configuration 

- Remote configuration 

- Local Area Network configuration 

References: HP 64700 Series Installation/Service manual 

2. If you are using the Remote configuration, you must have 
completed installation and configuration of a terminal 
emulator program which will allow your host to act as a 
terminal connected to the emulator. In addition, you must start 
the terminal emulator program before you can work the 
examples in this chapter. 

3. If you have properly completed steps 1 and 2 above, you 
should be able to hit <RETURN> (or <ENTER> on some 
keyboards) and get one of the following command prompts on 
your terminal screen: 

U> 
R> 
M> 

If you do not see one of these command prompts, retrace your 
steps through the hardware and software installation 
procedures outlined in the manuals above, verifying all 
connections and procedural steps. 

In any case, you must have a command prompt on your 
terminal screen before proceeding with the tutorial. 

A Look at the Sample The sample program used in this chapter is listed in figure 2-1 . The 
Program program emulates a primitive command interpreter. 
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NAME cmd_rds 

PUBLIC Msgs, Init, Cmd_Input , Msg_Dest 

COMN SEGMENT PARA COMMON ' COMN' 

****************************************************** 

Command input byte. 

Cmd_Input DB ? 

Destination of the command message. 
****************************************************** 

Msg_Dest DB 20H DUP (?) 

EVEN 

DW 6FH DUP (?) ; Stack area. 

Stk LABEL WORD 

COMN ENDS 

DATA SEGMENT PARA PUBLIC 'DATA' 

Msgs LABEL BYTE 

Msg_A DB "Command A entered 11 

Msg_B DB "Command B entered " 

Msg_I DB "Invalid Command " 

End_Msgs LABEL BYTE 

DATA ENDS 

CODE SEGMENT PARA PUBLIC 'CODE' 

ASSUME PS : CODE, DSO : DATA, DS1 : COMN, SS : COMN 
****************************************************** 

The following instructions initialize segment 
regsiters and set up the stack pointer. 
****************************************************** 

Init: MOV AW, DATA 

MOV DSO, AW 

MOV AW, COMN 

MOV DS1,AW 

MOV S S , AW 

MOV SP, OFFSET Stk 
****************************************************** 

Clear previous command 
****************************************************** 

Read_Cmd: MOV Cmd_lnput,0 

NOP 

****************************************************** 
Read command input byte. If no command has been 
entered, continue to scan for command input. 

****************************************************** 

Scan: MOV AL, Cmd_Input 

CMP AL, 0 

BE Scan 

****************************************************** 
A command has been entered. Check if it is 

command A, command B, or invalid. 
****************************************************** 




Figure 2-1 Sample program listing 
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Exe_Cmd: CMP AL, 41H 

BE Cmd_A 
CMP AL,42H 
BE Cmd_B 
BR Cmd_I 

****************************************************** 
Command A is entered. CW = the number of bytes in 
message A. BP = location of the message. Jump to 
the routine which writes the message. 



***************************************************** 
Cmd_A: MOV CW, Msg_B-Msg_A 

MOV IX, OFFSET Msg_A 

BR Write_Msg 
****************************************************** 

Command B is entered. 
****************************************************** 

Cmd_B: MOV CW, Msg_I-Msg_B 

MOV IX, OFFSET Msg_B 

BR Write_Msg 
****************************************************** 

An invalid command is entered. 
****************************************************** 

Cmd_I: MOV CW, End_Msgs-Msg_I 

MOV IX, OFFSET Msg_I 

Message is written to the destination. 
****************************************************** 

Write_Msg: MOV I Y, OFFSET Msg_Dest 

REP MOVBK Msg_Dest,Msgs 
****************************************************** 

The rest of the destination area is filled 
with zeros . 

****************************************************** 
Fill_Dest: XOR AL, AL 

MOV CW, OFFSET Msg_Dest+20H 

SUB CW, IY 

REP STM Msg_Dest 
****************************************************** 

Go back and scan for next command 
****************************************************** 

BR Read_Cmd 

CODE ENDS 

END Init 



Figure 2-1 Sample program (Cont'd) 
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Data Declarations 



The area at DATA segment defines the messages used by the program 
to respond to various command inputs. These messages are labeled 
Msg_A, Msg_B, and Msg_I. 

Initialization 

The program instructions from the Init label to the Read_Cmd label 
perform initialization. The segment registers are loaded and the stack 
pointer is set up. 

Reading Input 

The instruction at the Read_Cmd label clears any random data or 
previous commands from the Cmdjnput byte. The Scan loop 
continually reads the Cmdjnput byte to see if a command is entered 
(a value other than OH). 

Processing Commands 

When a command is entered, the instructions from Exe_Cmd to 
Cmd_A determine whether the command was "A", "B", or an invalid 
command. 

If the command input byte is "A" (ASCII 41H), execution is transferred 
to the instructions at Cmd_A. 

If the command input byte is "B" (ASCII 42H), execution is transferred 
to the instructions at Cmd_B. 

If the command input byte is neither "A" nor "B", i.e. an invalid 
command has been entered, then execution is transferred to the 
instructions at Cmd_I. 

The instructions at Cmd_A, Cmd_B, and Cmd_I load register CW 
with the length of the message to be displayed and register IX with the 
starting location of the appropriate message. Then, execution transfers 
to Write_Msg where the appropriate message is written to the 
destination location, Msg_Dest. 
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After the message is written, the instructions at Fill_Dest fill the 
remaining destination locations with zeros. (The entire destination area 
is 20H bytes long.) Then, the program jumps back to read the next 
command. 

The Destination Area 

The area at COMN segment declares memory storage for the command 
input byte, the destination area, and the stack area. 



Using the "help" The HP 64700 Series emulator' s Terminal Interface provides an 

FflP i I itv excellent help facility to provide you with quick information about the 

* various commands and their options. From any system prompt, you 

can enter "help" or "?" as shown below. 

R> help 



help - display help information 

help <group> - print help for desired group 

help -s <group> - print short help for desired group 

help <command> - print help for desired command 

help - print this help screen 

VALID <group> NAMES 

gram - system grammar 

proc - processor specific grammar 

sys - system commands 

emul - emulation commands 

trc - analyzer trace commands 

* - all command groups 



Commands are grouped into various classes. To see the commands 
grouped into a particular class, you can use the help command with that 
group. Viewing the group help information in short form will cause the 
commands or the grammar to be listed without any description. 

For example, if you want to get some information for group gram, enter 
"help gram". Following help information should be displayed. 

R> help gram 
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gram - system grammar 



SPECIAL CHARACTERS 

# - comment delimiter ; - command separator Ctl C - abort signal 

{} - command grouping "" - ascii string ,v - ascii string 

Ctl R - command recall Ctl B - recall backwards 

EXPRESSION EVALUATOR 

number bases : t-ten y-binary q-octal o-octal h-hex 

repetition and time counts default to decimal - all else default to hex 

operators: () -*/%+-<< <<< >> >>> & * I && 

PARAMETER SUBSTITUTION 

stokens - pseudo-parameter included in macro definition 

- cannot contain any white space between s pairs 

- performs positional substitution when macro is invoked 

Example 

Macro definition: mac getf ile= { load -hbs "transfer -t &file&"} 
Macro invocation: getfile MYFILE.o 

Expanded command: load -hbs"transfer -t MYFILE.o" 

Help information exists for each command. Additionally, there is help 
information for each of the emulator configuration items. 



Becoming Familiar 
with the System 
Prompts 



A number of prompts are used by the HP 64700 Series emulators. 
Each of them has a different meaning, and contains information about 
the status of the emulator before and after the commands execute. 
These prompts may seem cryptic at first, but there are two ways you 
can find out what a certain prompt means. 



Using "help proc" to View Prompt Description 

The first way you can find information on the various system prompts 
is to look at the proc help text. 

R> help proc 
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Address format 

32 bit ( seg : of f ) logical, extended 32 bit ( seg : : of f ) logical, 
2 4 physical, or 9 bit physical (@iram) 

Emulation Prompt Status Characters 



u - 


running user code 


M 


- running in monitor 


c - 


slow clock 


r 


- target reset 


R - 


emulation reset 


s 


- stop 


h - 


halt 


b 


- slow bus cycle 


g - 


hold 


T 


- awaiting target reset 


w - 


awaiting CMB ready 


9 


- unknown state 



Analyzer STATUS Field Equates 



exec 


- execute instruction 


dma 


- DMA memory access 


fetch 


- program fetch 


int 


- interrupt acknowledge 


read 


- read 


refresh 


- refresh cycle 


write 


- write 


halt 


- halt 


mem 


- memory access 


hold 


- hold acknowledge 


io 


- I/O accesscpu 


stop 


- stop 


sfr 


- SFR access 


wrrom 


- write to rom 


cpu 


- cpu cycle 


grd 


- guarded memory access 


ms 


- macro service 


fg 


- foreground 


memio 


- mem io dma 


bg 


- background 


memsfr 


- mem SFR dma 







Using the Emulation Status Command (es) for Description 
of Current Prompt 

When using the emulator, you will notice that the prompt changes after 
entering certain commands. If you are not familiar with a new prompt 
and would like information about that prompt only, enter the es 
(emulation status) command for more information about the current 
status. 

U> es 

N70433 — Running user program 



Initializing the If you plan to follow this tutorial by entering commands on your 

EfTI U I a tO r emulator as shown in this chapter, verify that no one else is using the 

'*"*" emulator. To initialize the emulator, enter the following command: 



R> init 

# Limited initialization completed 



The init command with no options causes a limited initialization, also 
known as a warm start initialization. Warm start initialization does not 
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affect system configuration. However, the init command will reset 
emulator and analyzer configurations. The init command: 

■ Resets the memory map. 

■ Resets the emulator configuration items. 

■ Resets the break conditions. 

■ Clears software breakpoints. 
The init command does not: 

■ Clear any macros. 

■ Clear any emulation memory locations; mapper terms are 
deleted, but if you respecify the same mapper terms, you will 
find that the emulation memory contents are the same. 

Other Types Of There are two options to init. The -p option specifies a powerup 

Initialization initialization, also known as a cold start initialization. It initializes the 
emulator, analyzer, system controller, and communications port; 
additionally, performance verification tests are run. 

The -c option also specifies a cold start initialization, except that 
performance verification tests are not run. 
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Set Up the Proper 

Emulation 

Configuration 



Emulation configuration is needed to adapting to your specific 
development. As you have initialized the emulator, the emulation 
configuration items have default value. 



Set Up Emulation 
Condition 



The emulator allows you to set the emulator's configuration setting 
with the cf command. Enter the help cf to view the information with 
the configuration command. 

R> help cf 

cf - display or set emulation configuration 

cf - display current settings for all config items 

cf <item> - display current setting for specified <item> 

Cf <i tem>=< V alue> - set new <value> for specified <item> 

Cf <item> <item> = <V a lue> <item> - set and display can be combined 

help cf <item> - display long help for specified <ltem> 

VALID CONFIGURATION NAMES 

elk - select clock source 

dsize - select data bus width 

hold - en/dis HLDRQ input from the target system 

mne - select mnemonic for inverse assembly 

mon - select foreground or background monitor 

nmi - en/dis NMI from the target system 

rad - select run address translation method 

rdy - relationship between emulator and target ready 

rrt - en/dis restriction to real time runs 

rsp - specify stack pointer after emulation reset 

rst - en/dis RESET input from the target system 

tdma - en/dis tracing DMA cycles 

trfsh - en/dis tracing of refresh cycles 



To view the current emulator configuration setting, enter the following 
command. 



R> cf 



cf clk=int 

cf dsize=16 

cf hold=en 

cf mne=70433 

cf mon=bg 

cf nmi=en 

cf rad=minseg 

cf rdy=lk 

cf rrt=dis 

cf rsp=0000 : 8000 

cf rst=en 

cf tdma=en 

cf trfsh=en 
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The individual configuration items won't be explained in this section; 
refer to the "CONFIG_ITEMS" in the "64768 Emulator Specific 
Command Syntax" appendix for details 



Set Up To avoid problems later while modifying and displaying memory 
AcceSS/Display locations, enter the following command: 

Modes 



R> mo -ab -db 

This sets the access and display modes for memory operation to byte.(if 
they are left at the default mode of word, the memory modification and 
display examples will not function correctly.) 



Mapping Memory Depending on the memory board, emulation memory consists of 128K 

, 512K or 1M bytes, mappable in 256 byte blocks. The monitor 
occupies 2K bytes, leaving 126K , 51 OK or 1022K bytes of emulation 
memory which you may use. The emulation memory system does not 
introduce wait states. 

The memory mapper allows you to characterize memory locations. It 
allows you specify whether a certain range of memory is present in the 
target system or whether you will be using emulation memory for that 
address range. You can also specify whether the target system memory 
is ROM or RAM, and you can specify that emulation memory be 
treated as ROM or RAM. 



Note 




Target system devices that take control of the bus (for example, 
external DMA controllers), cannot access emulation memory. 



Blocks of memory can also be characterized as guarded memory. 
Guarded memory accesses will generate "break to monitor" requests. 
Writes to ROM will also generate "break to monitor" requests if the 
rom break condition is enabled. Memory is mapped with the map 
command. To view the memory mapping options, enter: 
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M> help map 



map - display or modify the processor memory map 



map 

map <addr> . . <addr> <type> 
map other <type> 
map -d <term#> 
map -d * 

-- VALID <type> OPTIONS 

eram - emulation ram 
erom - emulation rom 
tram - target ram 
trom - target rom 
grd - guarded memory 



display the current map structure 
define address range as memory type 
define all other ranges as memory type 
delete specified map term 
delete all map terms 



Enter the map command with no options to view the default map 
structure. 

M> map 

# remaining number of terms : 16 

# remaining emulation memory : lf8000h bytes 
map other tram 



Which Memory Typically, assemblers generate relocatable files and linkers combine 

Locations ShOUld be relocatable files to form the absolute file. A linker load map listing will 

. . . _ show what memory locations your program will occupy. One for the 

" sample program is shown below. 



Hewlett-Packard ldv20 Tue Jul 2 13:18:08 1991 

HPB1445-19300 A. 03. 00 09Oct91 Copr . HP 1990 
Command line: ldv20 -c cmd_rds . k -Lh 

NAME cmd_rds 
SEG /COMN=400h 
SEG /DATA=600h 
SEG /CODE=800h 
LOAD cmd_rds . o 
END 

OUTPUT MODULE NAME: cmd_rds 

OUTPUT MODULE FORMAT: HP64000 absolute 



MODULE SUMMARY 
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MODULE SEGMENT CLASS HP SECTION START END 



cmd_rds /usr/hp64000/demo/emul/hp64768/cmd_rds . o 



CODE 
COMN 
DATA 



CODE 
COMN 
DATA 



PROG 
DATA 
COMMON 



00800 00859 
00400 004FF 
00600 00635 



SEGMENT SUMMARY 



SEGMENT 


CLASS 


GROUP 


START 


END 


LENGTH 


ALIGNMENT 


COMBINE 


COMN 


COMN 




00400 


004FF 


00100 


Paragraph 


Common 


DATA 


DATA 




00600 


00635 


00036 


Paragraph 


Public 


CODE 


CODE 




00800 


00859 


0005A 


Paragraph 


Public 


??SEG 






00000 


00000 


00000 


Paragraph 


Public 


? 7DATA1 


77INIT 




00000 


00002 


00003 


Byte 


Common 



START ADDRESS: 00080:00000 - 00800 
Load completed. 



From the load map listing, you can see that the sample program 
occupies three address ranges. The program area, which contains the 
opcodes and operands, occupies locations 800 through 859 hex. The 
data area, which contains the ASCII values of the messages the 
program transfers, occupies locations 600 through 635 hex. The 
destination area, which contains the command input byte and the 
locations of the message destination, occupies locations 400 through 
4FF hex. 

Since the program writes to the destination area, the mapper block of 
destination area should not be characterized as ROM. Enter the 
following commands to map memory for the sample program and 
display the memory map. 

R> map 0..4ff eram 
R> map 600..9ff erom 
R> map 



# remaining number of terms : 14 

# remaining emulation memory : lefOOh bytes 
map 0000000 .. 00004ff eram # term 1 

map 0000600 .. 00009ff erom # term 2 
map other tram 

When mapping memory for your target system programs, you should 
characterize emulation memory locations containing programs and 
constants (locations which should not be written) as ROM. This will 
prevent programs and constants from being written over accidentally. 
Break will occur when instructions or commands attempt to do so (if 
the rom break condition is enabled). 
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Getting the 
Sample Program 
into Emulation 
Memory 



This section assumes you are using the emulator in one of the following 
three configurations: 

1. Connected only to a terminal, which is called the standalone 
configuration. In the standalone configuration, you must 
modify memory to load the sample program. 



2. Connected between a terminal and a host computer, which is 
called the transparent configuration. In the transparent 
configuration, you can load the sample program by 
downloading from the "other" port. 



3. Connected to a host computer and accessed via a terminal 
emulation program (for example, the terminal window of the 
PC Interface). This configurations is called remote 
configurations. In the remote configuration, you can load the 
sample program by downloading from the same port. 



Standalone 
Configuration 



If you are operating the emulator in the standalone configuration, the 
only way to load the sample program into emulation memory is by 
modifying emulation memory locations with the m (memory 
display/modification) command. 

You can enter the sample program into memory with the m command 
as shown below. 



R> m -db 800=0b8, 60, 0, 8e, 0d8, 0b8, 40, 0, 8e, OcO, 8e, OdO, Obc, 0, 1, 26 

R> m -db 810 = 0c6, 6, 0, 0, 0, 26, OaO, 0, 0, 3c, 0, 74, Of 8, 3c, 41, 74 

R> m -db 820 = 0d, 90, 90, 3c, 42, 74, 12, 90, 90, Oeb, 19, 90, 90, 90, 0b9, 12 
R> m -db 830=0, Obe, 0, 0, Oeb, 14, 90, 90, 90, 0b9, 12, 0, Obe, 12, 0, Oeb 

R> m -db 840=09, 90, 90, 90, 0b9, 12, 0, Obe, 24, 0, Obf , 1, 0, Of 3, 0a4, 32 

R> m -db 850=0c0, 0b9, 21, 0, 2b, Ocf , Of 3, Oaa, Oeb, 0b5 

R> m -db 600="Command A entered Command B entered Invalid command 



After entering the opcodes and operands, you would typically display 
memory in mnemonic format to verify that the values entered are 
correct (see the example below). If any errors exist, you can modify 
individual locations. Also, you can use the cp (copy memory) 
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command if, for example, a byte has been left out, but the locations 
which follow are correct. 



Note Mfil Be careful about using this method to enter programs from the listings 

«8 of relocatable source files. If source files appear in relocatable sections, 

the address values of references to locations in other relocatable 
sections are not resolved until link-time. The correct values of these 
address operands will not appear in the assembler listing. 



Transparent 
Configuration 



If your emulator is connected between a terminal and a host computer, 
you can download programs into memory using the load command 
with the -o (from other port) option. The load command will accept 
absolute files in the following formats: 



■ HP absolute. 



■ Intel hexadecimal. 



■ Tektronix hexadecimal. 



■ Motorola S-records. 

The examples which follow will show you the methods used to 
download HP absolute files and the other types of absolute files. 



HP Absolutes 

Downloading HP format absolute files requires the 
transfer protocol. The example below assumes that the transfer utility 
has been installed on the host computer (HP 64884 for HP 9000 Series 
500, or HP 64885 for HP 9000 Series 300). 
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4 



Note SI Notice that the transfer command on the host computer is terminated 

with the <ESCAPE>g characters; by default, these are the characters 
which temporarily suspend the transparent mode to allow the emulator 
to receive data or commands. 



R> load -hbo <RETURN> <RETURN> 
$ transfer -rtb cmd_rds.X <ESCAPE>g 

#### 

R> 



Other Supported Absolute Files 

The example which follows shows how to download Intel hexadecimal 
files by the same method (but different load options) can be used by 
load Tektronix hexadecimal and Motorola S -record files as well. 

R> load -io <RETURN> <RETURN> 
$ cat ihexfile <ESCAPE>g 

##### 

Data records = 00003 Checksum error = 00000 
R> 



Remote Configuration If the emulator is connected to a host computer, and you are accessing 

the emulator from the host computer via a terminal emulation program, 
you can also download files with the load command. However, in the 
remote configuration, files are loaded from the same port that 
commands are entered from. For example, if you wish to download a 
Tektronix hexadecimal file from a Vectra personal computer, you 
would enter the following commands. 

R> load -t <RETURN> 

After you have entered the load command, exit from the terminal 
emulation program to the MS-DOS operating system. Then, copy your 
hexadecimal file to the port connected to the emulator, for example: 

C:\copy thexfile com1 : <RETURN> 

Now you can return to the terminal emulation program and verify that 
the file was loaded correctly. 
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For More Information For more information on downloading absolute files, refer to the load 

command description in the HP 64700 Emulators Terminal Interface: 
User's Reference manual. 



l-03ClinC| 3n ASCII The 64768 emulator supports the use of symbolic references in the 

SvmbOl Fi lG terminal interface. The symbols can be loaded with a program file, as is 

* the case with Intel OMF files . They can also be loaded from an ASCII 

text file on a host system. 

The symbols used are defined in a file using a text editor, or any other 
means to create the file. Refer to the HP 64700-Series Emulators 
Terminal Interface Reference for information on the format of the file. 
The file is then transferred to the emulator using the load command. 

You can create a text file named "cmd_rds.SYM" on your HP-UX host 
system. The file will look something like as follows. 

# 

cmd_rds : 
Init 800 
Read_Cmd 80f 
Scan 815 
Exe_Cmd 8 Id 
Cmd_A 8 2e 
Cmd_B 83 9 
Cmd_I 844 
Write_Msg 84a 
Fill_Dest 84f 
# 

Use the "-S" option on the load command to transfer the file. 

R> load -Sos "cat cmd_rds . SYM" 

The symbols can then be manipulated with the "sym" command, and 
used in commands at the command line. If the load is not successful, 
the nature of the error will be reported. 

R> sym 
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sym cmd_rds : Init=000800 
sym cmd_rds : Read_Cmd=00080f 
sym cmd_rds : Scan=000815 
sym cmd_rds : Exe_Cmd=00081d 
sym cmd_rds : Cmd_A=00082e 
sym cmd_rds : Cmd_B=000 83 9 
sym cmd_rds : Cmd_I=000844 
sym cmd_rds : Write_Msg=00084a 
sym cmd_rds : Fill_Dest=00084f 



Refer to the "Execution Topics" section in the "Emulation Topics" 
chapter and the "ADDRESS" section in the "64768 Emulator Specific 
Command Syntax" appendix. 



DiSplSyiflQ Once you have loaded a program into the emulator, you can verify that 

the program has inc 
mnemonic format. 



MeiTIOry In t ' 1C P ro S ram nas indeed been loaded by displaying memory in 



Mnemonic Format 



R> m -dm 800. .858 



0000800 




MOV AW, 0060 


0000803 




MOV DS0,AW | MOV AW, 0040 


0000808 




MOV DS1,AW | MOV SS,AW 


000080f 




MOV DS1 : BYTE PTR 0000,00 


0000815 




MOV AL, DS1 : BYTE PTR 0000 


000081a 




CMP AL,00 


000081c 




BE/Z 00815 


000081e 




CMP AL,41 


0000820 




BE/Z 0082e 


0000821 




NOP 


0000822 




NOP 


0000823 




CMP AL,42 


0000825 




BE/Z 00439 


0000827 




NOP 


0000828 




NOP 


0000829 




BR SHORT 00844 


000082b 




NOP 


000082c 




NOP 


000082d 




NOP 


000082e 




MOV CW, 0012 


0000831 




MOV IX, 0000 


0000834 




BR SHORT 0084a 


0000836 




NOP 


0000837 




NOP 


0000838 




NOP 


0000839 




MOV CW, 0012 


000083c 




MOV IX, 0012 


000083f 




BR SHORT 0084a 


0000841 




NOP 


0000842 




NOP 
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OOOOS 


543 - 


NOP 


oooos 


544 - 


MOV CW, 0012 


oooos 


547 - 


MOV IX, 0024 


OOOOi 


54a - 


MOV IY,0001 


oooos 


54d - 


REP/E/Z MOVBKB 


oooos 


54f - 


XOR AL,AL 


oooos 


551 - 


MOV CW, 0021 


oooos 


554 - 


SUB CW, IY 


oooos 


556 - 


REP/E/Z STMB 


oooos 


558 - 


BR SHORT 0080f 



If you display memory in mnemonic format and do not recognize the 
instructions listed or see some illegal instructions or opcodes, go back 
and make sure the memory locations you have typed are mapped 
properly. If the memory map is not the problem, recheck the linker load 
map listing to verify that the absolute addresses of the program match 
with the locations you are trying to display. 

If you have loaded symbols with the sample program, the display will 
include the symbols in the memory display. 



oooos 


500 


cmd_rds 


: Init 


MOV AW, 0060 






oooos 


503 






MOV DS0,AW 


MOV 


AW, 004 0 


oooos 


508 






MOV DS1,AW 


MOV 


SS,AW | MOV 


oooos 


50f 


md_rds : Read_Cmd 


MOV DS1 : BYTE 


PTR 


0000, 00 


oooos 


515 


cmd_rds 


: Scan 


MOV AL, DS1 : BYTE PTR 0000 


oooos 


519 






CMP AL,00 






oooos 


51b 






BE/Z cmd_Rds : 


: Scan 


oooos 


51d 


cmd_rds 


: Exe_Cmd 


CMP AL,41 






oooos 


51f 






BE/Z cmd_rds : 


: Cmd_ 


_A 


oooos 


521 






NOP 






oooos 


522 






NOP 






oooos 


523 






CMP AL,42 






oooos 


525 






BE/Z cmd_rds : 


: Cmd_ 


_B 


oooos 


527 






NOP 






oooos 


528 






NOP 






oooos 


529 






BR SHORT cmd_ 


_Rds : 


: Cmd_I 


oooos 


52b 






NOP 






oooos 


52c 






NOP 






oooos 


52d 






NOP 






oooos 


52e 


cmd_rds 


: Cmd_A 


MOV CW, 0012 






oooos 


531 






MOV IX, 0000 






oooos 


534 






BR SHORT cmd_ 


_rds : 


: Write_Msg 


oooos 


536 






NOP 






oooos 


537 






NOP 






oooos 


538 






NOP 






oooos 


539 


cmd_rds 


: Cmd_B 


MOV CW, 0012 






oooos 


53c 






MOV IX, 0012 






oooos 


53f 






BR SHORT cmd_ 


_rds; 


Write_Msg 


oooos 


541 






NOP 






oooos 


542 






NOP 






oooos 


543 






NOP 






oooos 


544 


cmd_rds 


: Cmd_I 


MOV CW, 0012 






oooos 


547 






MOV IX, 0024 






oooos 


54a 


d_rds : Write_Msg 


MOV IY,0001 






oooos 


54d 






REP/E/Z MOVBKB 
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000084f d_rds :Fill_Dest XOR AL,AL 

0000851 - MOV CW, 0021 

0000854 - SUB CW, IY 

0000856 - REP/E/Z STMB 

0000858- BR SHORT cmd_rds : Read_Cmd 



4 



Note VBm The comman d processor retains the name of the last module referenced. 

If a symbol does not contain a module name, the list of global symbols 
is searched. If the symbol is not found, the list of user symbols is 
searched. If the symbol is still not found, the system searches the last 
module referenced. If it doesn't find it there, the rest of the modules are 
searched. 



Stepping Through The emulator allows you to execute one instruction or a number of 
the PrOQ ram instructions with the s (step) command. Enter the help s to view the 

^ options available with the step command. 

R> help s 



s - step emulation processor 



s - step 

s <count> - step 

s <count> $ - step 

s <count> <addr> - step 

s -q <count> <addr> - step 

s -w <count> <addr> - step 



one from current PC 

<count> from current PC 

<count> from current PC 

<count> from <addr> 

<count> from <addr>, quiet mode 

<count> from <addr>, whisper mode 



NOTES 

STEPCOUNT MUST BE SPECIFIED IF ADDRESS IS SPECIFIED! 

If <addr> is not specified, default is to step from current PC. 

A <count> of 0 implies step forever. 



A step count of 0 will cause the stepping to continue "forever" (until 
some break condition, such as "write to ROM", is encountered, or until 
you enter <CTRL>c). The following command will step from the first 
address of the sample program. 

R> s 1 0:800 
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00000:00800 cmd_rds:Init MOV AW, 0060 

PC = 00000:00803 



4 



Note Wm There are cases in which the emulator can not step. Step command is 

not accepted between each of the following instructions and the next 
instruction. 

1) Instructions that manipulate for sreg or xreg: MOV sreg,regl6, 
MOV sreg,meml6, POP sreg, MOV xsreg,regl6, 
MOV xsreg,meml6, POP xsreg. 

2) Prefix instructions: PS:, SS:, DS0:, DS1:, DS2:, DS3:, IRAM, 
REPC, REPNC, REP, REPE, REPZ, REPNE, REPNZ, 
BUSLOCK. 

3) EI, DI, RETI, RETRBI. 

4) POP PSW. 

5) FINT. 

6) BRKCS, BRK 3, BRK imm8, BRKV(V=1), 
CHKIND(mem32>regl6 or (mem32+2)<regl6), FPOl fp-op; 
FPOl fp-op,mem;, FP02 fp-op;, FP02 fp-op,mem;, TSKSW, 
MOVSPB, MOVSPA. 

7) RSTWDT. 

8) The first instruction of interrupt processing routine. 



Displaying The step command shown above executed the MOV AW,0060H 

Dpfi jctprc; instruction. Enter the following command to view the contents of the 

registers. 

M> reg * 

reg ps=0000 pc=0803 psw=f002 aw=0060 bw=0000 cw=0000 dw=0000 sp=8000 bp=0000 
reg ix=0000 iy=0000 ds0=0000 dsl=0000 ds2=0000 ds3=0000 ss=0000 

The register contents are displayed in a "register modify" command 
format. This allows you to save the output of the reg command to a 
command file which may later be used to restore the register contents. 
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(Refer to the po (port options) command description in the erminal 
Interface: User's Reference for more information on command files.) 



Refer to the "REGISTER CLASS and NAME" section in the "64768 
Emulator Specific Command Syntax" appendix for more information 
on the register names and classes. 



Combining 
Commands 



More than one command may be entered in a single command line. The 
commands must be separated by semicolons (;). For example, you 
could execute the next instruction(s) and display the registers by 
entering the following. 

M> s;reg 



00000:00803 - MOV DS0,AW | MOV AW, 0040 

PC = 00000:00808 

reg ps=0000 pc=0808 psw=f002 aw=0040 bw=0000 cw=0000 dw=0000 sp=8000 bp=0000 
reg ix=0000 iy=0000 ds0=0060 dsl=0000 ds2=0000 ds3=0000 ss=0040 



The sample above shows you that MOV DS0,AW and MOV 
AW,0040H are executed by step command. Refer to the Note above, 
for the reason why two instructions are executed. 

Using Macros Suppose you want to continue stepping through the program and 
displaying registers after each step. You could continue entering s 
commands followed by reg commands, but you may find this tiresome. 
It is easier to use a macro to perform a sequence of commands which 
will be entered again and again. 

Macros allow you to combine and store commands. For example, to 
define a macro which will display registers after every step, enter the 
following command. 

M> mac st={s;reg} 

Once the st macro has been defined, you can use it as you would use 
any other command. 

M>St 



# s ; reg 

00000:00808 - MOV DS1,AW I MOV SS,AW | MOV SP,010 

PC = 00000:0080f 

reg ps=0000 pc=080f psw=f002 aw=0040 bw=0000 cw=0000 dw=0000 sp=0100 bp=0000 
reg ix=0000 iy=0000 ds0=0060 dsl=0040 ds2=0000 ds3=0000 ss=0040 
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Command Recall The command recall feature is yet another, easier way to enter 

commands again and again. You can press <CTRL>r to recall the 
commands which have just been entered. If you go past the command 
of interest, you can press <CTRL>b to move forward through the list of 
saved commands. To continue stepping through the sample program, 
you could repeatedly press <CTRL>r to recall and <RETURN> to 
execute the st macro. 



Repeating Commands The rep command is also helpful when entering commands 

repetitively. You can repeat the execution of macros as well as normal 
commands. For example, you could enter the following command to 
cause the st macro to be executed four times. 

M> rep 4 st 

# s ; reg 

00000:0040f MOV DS1 : 0000, 00 

PC = 00000:00815 

reg ps=0000 pc=0815 psw=f002 aw=0040 bw=0000 cw=0000 dw=0000 sp=0100 bp=0000 
reg ix=0000 iy=0000 ds0=0060 dsl=0040 ds2=0000 ds3=0000 ss=0040 

# s ; reg 

00000:00815 - MOV AL, DS 1 : BYTE PTR 0000,00 

PC = 00000:00819 

reg ps=0000 pc=0819 psw=f002 aw=0000 bw=0000 cw=0000 dw=0000 sp=0100 bp=0000 
reg ix=0000 iy=0000 ds0=0060 dsl=0040 ds2=0000 ds3=0000 ss=0040 

# s ; reg 

00000:00819 - CMP AL, 00 

PC = 00000:0081b 

reg ps=0000 pc=081b psw=f046 aw=0000 bw=0000 cw=0000 dw=0000 sp=0100 bp=0000 
reg ix=0000 iy=0000 ds0=0060 dsl=0040 ds2=0000 ds3=0000 ss=0040 

# s ; reg 

00000:0081b MOV AL, DS1 : 0000 

PC = 00000:00815 

reg ps=0000 pc=0815 psw=f046 aw=0000 bw=0000 cw=0000 dw=0000 sp=0100 bp=0000 
reg ix=0000 iy=0000 ds0=0060 dsl=0040 ds2=0000 ds3=0000 ss=0040 



The terminal interface supports the use of HP-UX ksh(l)-like editing 
of the command line. The default is for the command line editing 
feature to be disabled to be compatible with earlier versions of the 
interface. Use the cl command to enable command line editing. 

M> cl -e 

Refer to "Command Line Editing" in the HP 64700-Series Emulators 
Terminal Interface Reference for information on using the command 
line editing feature. 



Command Line 
Editing 
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Modify inQ M6m0ry The preceding step and register commands show the sample program is 

executing Scan loop, where it continually reads the command input 
byte to check if a command had been entered. Use the m (memory) 
command to modify the command input byte. 

M> m 400=41 

To verify that 41 H has been written to 400H, enter the following 
command. 



0000400 .. 0000400 41 



M> m -db 400 

When memory was displayed in byte format earlier, the display mode 
was changed to "byte". The display and access modes from previous 
commands are saved and they become the defaults. 



Specifying the 
Access and Display 
Modes 



-ab -db 



0000400 .. 0000400 0041 



There are a couple different ways to modify the display and access 
modes. One is to explicitly specify the mode with the command you are 
entering, as with the command m -db 400. The mo (display and access 
mode) command is another way to change the default mode. For 
example, to display the current modes, define the display mode as 
"word", and redisplay 400H, enter the following commands. 

M> mo 

M> mo -dw 
M> m 400 

To continue the rest of program. 

M>r 

U> 

Display the Msg_Dest memory locations (destination of the message, 
401H) to verify that the program moved the correct ASCII bytes. At 
this time you want to see correct byte values, so "-db" option (display 
with byte) is used. 

U>m -db 401 ..420 



0000401 .. 0000410 43 6f 6d 61 6e 64 20 41 20 65 6e 74 65 72 65 
0000411 .. 0000420 64 20 00 00 00 00 00 00 00 00 00 00 00 00 00 
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Running the 
Sample Program 



Note 



4 



The emulator allows you to execute a program in memory with the r 
command. The r command by itself causes the emulator to begin 
executing at the current program counter address. The following 
command will begin running the sample program from 800h. 

M> r 800 



The defaults number base for address and data values within HP 64700 
Terminal Interface is hexadecimal. Other number bases may be 
specified. Refer to the "Expressions" chapter or the HP 64700 Terminal 
Interface Reference manual for further details. 



The r rst command specifies that the emulator begin to executing from 
target system reset (see the "Execution Topics" section in the 
"In-Circuit Emulation" chapter). 



Searching The ser (search memory for data) command is another way to verify 

MemO ry f O r Data * at ^ P ro 8 ram did what it was supposed to do. 

U> ser 400..420="Command A entered " 

pattern match at address: 0000401 

If any part of the data specified in the ser command is not found, no 
match is displayed (No message displayed). 
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Breaking into the 
Monitor 



You can use the break command (b) command to generate a break to 
the monitor. While the break will occur as soon as possible, the actual 
stopping point may be many cycles after the break request (depending 
on the type of instruction being executed and whether the processor is 
in a special state). 

U>b 

M> 



4 



N Ote K£& If DMA transfer is in progress with BURST or DEMAND-RELEASE 
transfer mode, the emulator breaks into monitor after such DMA 
transfers are completed. 



Using Software 
Breakpoints 



Software breakpoints are handled by the 70433 BRK 3 instruction. 
When you define or enable a software breakpoint(whit the bp 
command), the emulator will replace the opcode at the software 
breakpoint address with a breakpoint interrupt instruction(BRK 3). 



Caution Software breakpoints should not be set, enabled, disabled, or removed 

while the emulator is running user code. If any of these commands are 
entered while the emulator is running user code and the emulator is 
executing code in the area where the breakpoint is being modified, 
program execution may be unreliable. 
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You must only set software breakpoints at memory locations which 
contain instruction opcodes (not operands or data). If a software 
breakpoint is set at a memory location which is not an instruction 
opcode, the software breakpoint instruction will never be executed. 
Further, your program won't work correctly. 



NMI will be ignored, when software breakpoint and NMI occur at the 
same time. 



Because software breakpoints are implemented by replacing opcodes 
with the BRK 3 instructions, you cannot define software breakpoints in 
target ROM. 

You can, however, copy target ROM into emulation memory(see the 
"Target ROM Debug Topics" section of the "In-Circuit Emulation" 
chapter). Then you can use software breakpoints. 



When software breakpoints are enabled and the emulator detects the 
BRK 3 interrupt instruction, it generates a break into the monitor. Since 
the system controller knows the locations of defined software 
breakpoints, it can determine whether the BRK 3 interrupt was 
generated by an enabled software breakpoint or by a BRK 3 instruction 
in your target program. 

If the BRK 3 interrupt was generated by a software breakpoint, 
execution breaks to the monitor, and the breakpoint interrupt 
instruction(BRK 3) is replaced by the original opcode. A subsequent 
run or step command will execute from this address. 

If the BRK 3 interrupt was generated by a BRK 3 interrupt instruction 
in the target program, execution still breaks to the monitor,and an 
"undefined breakpoint" status message is displayed. To continue 
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program execution, you must run or step from the target program's 
breakpoint interrupt vector address. 



Displaying and 
Modifying the Break 
Conditions 



be -d bp tdisable 
be -e rom tenable 
be -d bnct #disable 
be -d cmbt #disable 
be -d trigl tdisable 
be -d trig2 tdisable 



Before you can define software breakpoints, you must enable software 
breakpoints with the be (break conditions) command. To view the 
default break conditions and change the software breakpoint condition, 
enter the be command with no option. This command displays current 
configuration of break conditions. 

M> be 



To enable the software break point feature enter 

M> be -e bp 



Now that the software breakpoint feature is enabled, you can define 
software breakpoints. Enter the following command to break on the 
address of the Cmd_I (address 844H) label. 

M> bp 844 
M> bp 

### BREAKPOINT FEATURE IS ENABLED ### 
bp 0000844 #enabled 

Run the program, and verify that execution broke at the appropriate 
address. 

M> r 0:800 
U> m 400=43 

!ASYNC_STAT 615! Software breakpoint: 00000:00844 

M>st 

# s;reg 

00000:00844 - MOV CW,0012 

PC = 00000:00847 

reg ps=0000 pc=0847 psw=f002 aw=00043 bw=0000 cw=0012 dw=0000 sp=0100 bp=0000 
reg ix=0012 iy=0021 ds0=0060 dsl=0040 ds2=0000 ds3=0000 ss=0040 

When a breakpoint is hit, it becomes disabled. You can use the -e 
option with the bp command to re-enable the software breakpoint. 

M> bp 

### BREAKPOINT FEATURE IS ENABLED ### 
bp 0000844 #disabled 



Defining a Software 
Breakpoint 
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M> bp -e 000844 

M> bp 

### BREAKPOINT FEATURE IS ENABLED ### 
bp 0000844 #enabled 

M>r 

U> m 400=43 

!ASYNC_STAT 615! Software breakpoint: 00000:00844 

M> bp 

### BREAKPOINT FEATURE IS ENABLED ### 
bp 0000844 #disabled 



Refer to the "Execution Topics" section in the "Emulation Topics" 
chapter and "ADDRESS" section in the "64768 Emulato r Specific 
Command Syntax" appendix. 



Using the Analyzer 

Predefined Trace Three trace labels are predefined in the 64768 emulator. You can view 
Labels these labels by entering the tlb (trace label) command with no options. 



#### Emulation trace labels 
tlb addr 0 . .23 
tlb data 24 . . 39 
tlb stat 40 . . 57 



M>tlb 



Predefined Status 
Equates 



Common values for the 64768 status trace signals have been 
predefined. You can view these predefined equates by entering the equ 
command with no options. 

M> equ 
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### Equates ### 
equ bg=OxxxxxxxxxxxxxxxxOxy 
equ cpu=0x0000xx01xxxlxxxxy 
equ dma=OxxOOOOxxllxxxlxxxxy 
equ exec=0xxxx01xxxxxxxxxxxxy 
equ f etch=OxxOOOOxxlOxxxlxxxxy 
equ f g=Oxxxxxxxxxxxxxxxxlxy 
equ grd=OxxxxOOxxxxxxxlxOxxy 
equ halt-Oxxllxxxxxxxxxlxxxxy 
equ hold=OxxxxxxxxxxxxxOxxxxy 
equ int=OxxxxlOxxxxxxxxxxxxy 
equ io=OxxOOOOxx01x001xxxxy 
equ mem=0xl0000xxxxxxxlxxxxy 
equ memio=0xx00000111xxxlxxxxy 
equ memsf r=OxxOOOOOO!lxxxlxxxxy 
equ ms=lxOOOOxx01xxxlxxxxy 
equ read=0xx0000xxxl0xxlxxxxy 
equ ref resh=OxxOOOOxx001xxlxxxxy 
equ sf r=0xx0000xx01xlllxxxxy 
equ stop=OxxlOxxxxxxxxxlxxxxy 
equ wr ite=0xx0000xxxl lxxlxxxxy 
equ wrrom=OxxxxOOxxxxxxxlOxxxy 



These equates may be used to specify values for the stat trace label 
when qualifying trace conditions. 

The tg analyzer command is a simple way to specify a condition on 
which to trigger the analyzer. Suppose you wish to trace the states of 
the program after the read of a "B" (42 hex) command from the 
command input byte. Enter the following commands to set up the trace, 
run the program, issue the trace, and display the trace status. (Note that 
the analyzer is to search for a lower byte read of 42H because the 
address is even.) 

M> tg addr=400 and data=0xx42 

If you wish to trace the odd address and the data, enter the following 
command to set up the trace (Note that the data value should be entered 
like as 0xx42 or 42xx when you specify that CPU's data bus size is 16 
bits in configuration.): tg addr=401 and data=42xx 

M>t 

emulation trace started 

M> r 0:800 
U>ts 



Specifying a Simple 
Trigger 
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Emulation Trace Status 

New User trace running 
Arm ignored 
Trigger not in memory 
Arm to trigger ? 
States ? (512) ? . . ? 
Sequence term 1 
Occurrence left 1 

The trace status shows that the trigger condition has not been found. 
You would not expect the trigger to be found because no commands 
have been entered. Modify the command input byte to "B"(42H) and 
display the trace status again. 

U> m 400=42 
U>ts 

Emulation Trace Status 

New User trace complete 
Arm ignored 
Trigger in memory 
Arm to trigger ? 
States 512 (512) 0 . .511 
Sequence term 2 
Occurrence left 1 

The trace status shows that the trigger has been found, and that 512 
states have been stored in trace memory. Enter the following command 
to display the first 20 states of the trace. 

U> tl -t 20 



Line addr,H 70433 mnemonic, H count, R seq 



0 


000400 


xx42 read mem 










1 


000819 


INSTRUCTION — opcode 


unavailable 


0 


320 


uS 


2 


00081c 


3cf8 fetch 




1 


600 


uS 


3 


00081b 


INSTRUCTION — opcode 


unavailable 


0 


320 


uS 


4 


08b923 


xxxx refresh 




1 


600 


uS 


5 


00081e 


7441 fetch 




1 


920 


uS 


6 


00081d 


CMP AL,41 




0 


320 


uS 


7 


000820 


900d fetch 




1 


600 


uS 


8 


00081f 


BE/Z 0082e 




0 


320 


uS 


9 


000822 


3c90 fetch 




1 


600 


uS 


10 


000821 


NOP 




0 


320 


uS 


11 


000822 


NOP 




1 


280 


uS 


12 


000824 


7442 fetch 




0 


320 


uS 


13 


000823 


CMP AL,42 




0 


960 


uS 


14 


08b925 


xxxx refresh 




0 


960 


uS 


15 


000826 


9012 fetch 




1 


920 


uS 


16 


000825 


BE/Z 00839 




0 


320 


uS 


17 


000828 


eb90 fetch 




1 


600 


uS 


18 


000839 


b9xx fetch 




1 


920 


uS 


19 


00083a 


0012 fetch 




1 


920 


uS 
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Line 0 in the trace list above shows the state which triggered the 
analyzer. The trigger state is always on line 0. 

To list the next lines of the trace, enter the following command. 
U>tl 



ne 


addr, H 


70433 mnemonic, H 


count, R 


20 


000 


839 


MOV CW, 


0012 


0 


.320 uS 


21 


08b 


927 


xxxx 


refresh 


1 


.600 uS 


22 


000 


83c 


12be 


fetch 


1 


.920 uS 


23 


000 


83c 


MOV IX, 


0012 


0 


.320 uS 


24 


000 


83e 


ebOO 


fetch 


1 


.600 uS 


25 


000 


840 


9009 


fetch 


1 


.920 uS 


26 


000 


83f 


BR SHORT 00 84a 


0 


.320 uS 


27 


000 


842 


9090 


fetch 


1 


.600 uS 


28 


000 


84a 


Olbf 


fetch 


1 


.920 uS 


29 


000 


84a 


MOV IY, 


0001 


0 


.320 uS 


30 


08b 


929 


xxxx 


refresh 


1 


.600 uS 


31 


000 


84c 


f 300 


fetch 


1 


.920 uS 


32 


000 


84e 


32a4 


fetch 


1 


.920 uS 


33 


000 


84d 


REP/E/Z 


MOVBKB 


0 


.640 uS 


34 


000 


850 


b9c0 


fetch 


1 


.280 uS 


35 


000 


852 


0021 


fetch 


1 


.920 uS 


36 


08b 


92b 


xxxx 


refresh 


1 


.920 uS 


37 


000612 


xx43 


read mem 


1 


.920 uS 


38 


000401 


43xx 


write mem 


2 


.880 uS 


39 


000613 


6f xx 


read mem 


1 


.920 uS 



seq 



Trigger Position You can specify where the trigger state will be positioned with in the 

emulation trace list. The following three basical trigger positions are 
defined. 

■ s start 

■ c center 

■ e end 

When s(start) trigger position is selected, the trigger is positioned at the 
start of the trace list. You can trace the states after the trigger state. 

When c(center) trigger position is selected, the trigger is positioned at 
the center of the trace list. You can trace the states around the trigger. 

When e(end) trigger position is selected, the trigger is positioned at the 
end of the trace list. You can trace the state before the trigger. 

In the above section, you have traced the states of the program after a 
certain state, because the default trigger position was s(start). If you 
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want to trace the states of the program around a certain state, you need 
to change the trigger position. 

For example, if you wish to trace the transition to the command A 
process, change the trigger position to "center" and specify the trigger 
condition. 

To specify the trigger position, enter the following command. 
U>tpc 

Specify the trigger condition by typing 

U> tg addr=82e and stat=exec 

Enter the trace command to start the trace. 
U>t 

Emulation trace started 

Modify the command input byte to "A" and display the trace status 
again. 

U> m 400=41 

U>ts 

Emulation Trace Status 

New User trace complete 

Arm ignored 

Trigger not in memory 

Arm to trigger ? 

States 512 (512) -257.. 254 

Sequence term 2 

Occurrence left 1 

The trace status shows that the trigger has been found. Enter the 
following command to display the states about the execution state of 
address 82eH. 

U>tl -10..9 
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Line 



addr,H 70433 mnemonic, H 



count, R seq 



-10 




pmp at nn 


Q 


320 


uS 


-9 


0 0 0 8 1 c 

U U U O J. c 


O J- O 1 c LU11 




600 


uS 


— 8 




rf / 7 nnBi r 

Dli / Zj UUOl J 


g 


320 


uS 


— 7 


0 4 8 9f 1 


XXXX 12 6 f 12 s s h 




600 


uS 


-6 


00081e 


7441 fetch 


1 


920 


uS 


-5 


00081d 


CMP AL,41 


0 


320 


uS 


-4 


000820 


900d fetch 


1 


600 


uS 


-3 


00081f 


BE/Z 0082e 


0 


320 


uS 


-2 


000822 


3c90 fetch 


1 


600 


uS 


-1 


00082e 


12b9 fetch 


1 


920 


uS 


0 


00082e 


MOV CW, 0012 


0 


320 


uS 


1 


0489f 3 


xxxx refresh 


1 


600 


uS 


2 


000830 


beOO fetch 


1 


920 


uS 


3 


000832 


0000 fetch 


1 


920 


uS 


4 


000831 


MOV IX, 0000 


0 


320 


uS 


5 


000834 


14eb fetch 


1 


600 


uS 


6 


000834 


BR SHORT 0084a 


0 


320 


uS 


7 


000836 


9090 fetch 


1 


600 


uS 


8 


0489f5 


xxxx refresh 


1 


920 


uS 


9 


00084a 


Olbf fetch 


1 


920 


uS 



The transition states to the process for the command A are displayed. 

For 3 Complete For a complete description of the HP 64700 Series analyzer, refer to the 
DeSCN ptiOII HP 64700 Emulators Terminal Interface: Analyzer User's Guide. 



Copying Memory 



The cp (copy memory) command gives you the ability to copy the 
contents of one range of memory to another. This is a handy feature to 
test things like the relocatability of programs, etc. To test if the sample 
program is relocatable within the same segment, enter the following 
command to copy the program to an unused, but mapped, area of 
emulation memory. After the program is copied, run it from its new 
start address to verify that the program is indeed relocatable. 

U> cp 900=800.-859 
U> r 0:900 

U> 
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Emulation trace started 



The prompt shows that the emulator is executing user code, so it looks 
as if the program is relocatable. You may want to issue a simple trace 
to verify that the program works while running from its new location. 

U> tg any 

U>t 



U>tl 



Line 


addr, H 


70433 mnemonic, H 




count , R 


0 


000915 


INSTRUCTION — opcode 


unavailable 






1 


000918 


3c00 


fetch 




1 


.280 uS 


2 


00091a 


7400 


fetch 




1 


.920 uS 


3 


000400 


xxOO 


read mem 




1 


.920 uS 


4 


000919 


CMP AL 


00 




0 


.320 uS 


5 


00091c 


3cf 8 


fetch 




1 


.600 uS 


6 


00091b 


BE/Z 0( 


)915 




0 


.320 uS 


7 


06193d 


xxxx 


refresh 




1 


.600 uS 


8 


000915 


2 6xx 


fetch 




1 


.920 uS 


9 


000916 


OOaO 


fetch 




1 


.920 uS 


10 


000915 


MOV AL 


DS1 : BYTE PTR 


0000 


0 


.640 uS 


11 


000918 


3c00 


fetch 




1 


.280 uS 


12 


00091a 


7400 


fetch 




1 


.920 uS 


13 


000400 


xxOO 


read mem 




1 


.920 uS 


14 


000919 


CMP AL 


00 




0 


.320 uS 


15 


06193f 


xxxx 


refresh 




1 


.600 uS 


16 


00091c 


3cf 8 


fetch 




1 


.920 uS 


17 


00091b 


BE/Z 0( 


)915 




0 


.320 uS 


18 


00091e 


7441 


fetch 




1 


.600 uS 


19 


000915 


2 6xx 


fetch 




1 


.920 uS 



seq 



Testing for 
Coverage 



For each byte of emulation memory, there is an additional bit of 
emulation RAM used by the emulator to provide coverage testing. 
When the emulator is executing the target program and an access is 
made to a byte in emulation memory, the corresponding bit of coverage 
memory is set. With the cov command, you can see which bytes in a 
range of emulation memory have (or have not) been accessed. 

For example, suppose you want to determine how extensive some test 
input is in exercising a program (in other words, how much of the 
program is covered by using the test input). You can run the program 
with the test input and then use the cov command to display which 
locations in the program range were accessed. 



Getting Started 2-35 



The examples which follow use the cov command to perform coverage 
testing on the sample program. Before performing coverage tests, reset 
all coverage bits to non-accessed by entering the following command. 

U> cov -r 

Run the program from the start address (00000 :00400H) and use the 
cov command to display how much of the program is accessed before 
any commands are entered (refer to the "Execution Topics" section in 
the "Emulation Topics" chapter and "ADDRESS" section in the "64768 
Emulator Specific Command Syntax" appendix). 

U> r 800 

R> cov -a 800..859 

# coverage list - list of address ranges accessed 
0000800 . . 000081f 

percentage of memory accessed: % 35.6 

Now enter the sample program commands "A", "B", and an invalid 
command ("C" will do); display the coverage bits for the address range 
of the sample program after each command. You can see that more of 
the sample program address range is covered after each command is 
entered. 

U> m 400=41 

U> cov -a 800..859 

# coverage list - list of address ranges accessed 
0000800 . . 0000823 

000082e. .0000839 
000084a. .0000859 

percentage of memory accessed: % 71.1 

U> m 400=42 

U> cov -a 800..859 

# coverage list - list of address ranges accessed 
0000800. .0000829 

000082e. .0000843 
000084a. .0000859 

percentage of memory accessed: % 88.9 

U> m 400=43 

U> cov -a 800..859 

# coverage list - list of address ranges accessed 
0000800 . . 0000859 

percentage of memory accessed: % 100.0 
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RGSGttiflQ th© To reset the emulator, enter the following command. 

Emulator 



U> rst 

R> 

The emulator is held in a reset state (suspended) until a b (break), r 
(run), or s (step) command is entered. A CMB execute signal will also 
cause the emulator to run if reset. 

The -m option to the rst command specifies that the emulator begin 
executing in the monitor after reset instead of remaining in the 
suspended state. 

R> rst -m 

M> 



Getting Started 2-37 



Notes 
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3 



Emulation Topics 



Introduction Many of the topics described in this chapter involve the commands 

which are unique to the 64768 emulator such as the cf command which 
allows you t o specify emulator configuration. 

A reference-type description of the 64768 emulator configuration items 
can be found in the " CONFIGJTEMS " section in the "64768 Emulator 
Specific Command Syntax" appendix. 

This chapter will: 

■ Describe how to run in real-time and how to break on an 
analyzer trigger,how to specify the address form, how to 
specify the default interpretation of physical run addresses, 
and how to break on an analyzer trigger. These topics are 
related to program execution in general. 

■ Describe how to locate the monitor, These topics are related to 
the monitor options. 

■ Describe how to do other things which do not fall into the 
categories mentioned above: how to access internal RAM/SFR. 



PrG f6C| U iS it 6S Before performing the tasks described in this chapter, you should be 

familiar with how the emulator operates in general. Refer to the 
Concepts of Emulation and Analysis manual and the "Getting Started" 
chapter of this manual. 
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Execution Topics 
Address Expression 



The descriptions in this section are of emulation tasks which involve 
program execution in general. 



The 64768 emulator allow you to use address forms as the following. 



■ physical address form: (e.g.,0ffff0) 

■ function code address form: (e.g.,Oef@iram) 

■ logical address form: (e.g.,0fff0:00ff) 

■ extended logical address form: (e.g.,0fff0::00ff) 

You must specify addresses in function code address form(the iram 
information), when you access Internal RAM space( addresses from 
000@iram to lff@iram). 

If you specify the address in 1M bytes memory space, you can specify 
addresses in either physical address form(00000 to Offfff) or logical 
address form. 

If you specify the address in 16M bytes memory space, you can specify 
addresses in either physical address form (000000 to Offffff) or 
extended logical address form. 
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The address expression is restricted by emulation commands as shown 
below. 



Table 3-1 Address Expression Matrix 



Command 
group 


Terminal 
command 


PHY_ADDR 


IRAM_ADDR 
@iram 


<SEGMENT>: 
<OFFSET> 


<XSEGMENT>: : 
<XOFFSET> 


Memory 
commands 


cp,dump, 
m,ser 


OK 


OK 


OK 


OK 


cim 


OK 


OK (*1) 


OK 


OK 


cov 


OK 


ERROR 


OK 


OK 


Run 
commands 

(*2) 


r,xr,s,ss 
(rad=maxseg) 


OK 


ERROR 


OK 


ERROR 


r,xr,s,ss 
(rad=minseg) 


OK 


ERROR 


OK 


ERROR 


r,xr,s,ss 
(rad=curseg) 


<SEGMENT> 
(0-OFFFFH) 


ERROR 


OK 


ERROR 


I/O 
command 


io 


OK 
(0-OFFFFH) 


ERROR 


ERROR 


ERROR 


Map 
command 


map 


OK 


ERROR 


ERROR 


ERROR 


Breakpoints 
command 


bp 


OK 
(0-OFFFFFH) 


ERROR 


OK 


ERROR 


Symbols 
command 


sym 


OK 


OK 


OK 


OK 



*1 : The emulator ignores a function code. 

*2 : Refer to the "cf rad" command in "CONFIG_ITEMS " section of "Emulation Specific 
Command Syntax" 
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Note Ha When you specify address range, you can not specify end address and 

^> start address in different address form respectively. But following form 

are permitted. 

■ physical, .physical @ iram(phy sical @ iram. .physical) 

physical address is recognized as function code address. 

■ segment:offset. .physical(physical..segment:offset) 

physical address is recognized as offset, and segment is 
same value. 

■ xsegment::xoffset..physical(physical..xsegment::xoffset) 

physical address is recognized as xoffset, and xsegment is 
same value. 



Default Physical tO The run and step commands allows you to enter addresses in ether 
Logical Run AddreSS logical address form(segment:offset) or physical address form. 

Conversion 



When a physical address(non-segment) is entered with either a run or 
step command, the emulator must convert it to a 
logical(segment: offset) address. By default, a physical run address is 
converted such that the low 16 bits of the address become the offset 
value. The physical address is right-sifted 4 bits and ANDed with 
0F000H to yield segment.Use the cf( configuration) command with 
rad(run address default conversion) configuration item to specify how 
the low 4 bits of physical address become the offset. The physical 
address is right-sifted 4 bits to yield the segment value. 

R> cf rad=minseg 

#phys_addr = 

((phys_addr >4) & 0xf000h):(phys_addr & Oxffff) 

R> cf rad=maxseg 

#phys_addr = 

(phys_addr >4):(phys_addr & Oxf) 
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To configure so that the physical address(Oh-Offffh) becomes the offset 
value, enter following command. The value of current program 
segment(PS) becomes the segment value. 

R> cf rad=curseg 

#phys_addr=(current segment): (entered value) 

If you use logical addresses other than the three methods shown above, 
you must enter run and step addresses in logical form. 



Restricting the 
Emulator to 
Real-Time Runs 



By default, the emulator is not restricted to real-time runs. However, 
you may wish to restrict runs to real-time to prevent accidental breaks 
that might cause target system problems. Use the cf (configuration) 
command to enable the rrt configuration item. 

R> cf rrt=en 

When runs are restricted to real-time and the emulator is running user 
code, the system refuses all commands that cause a break except rst 
(reset), r (run), s (step), and b (break to monitor). 

Because the emulator contains dual-port emulation memory, commands 
which access emulation memory are allowed while runs are restricted 
to real-time. 

The following commands are not allowed when runs are restricted to 
real-time: 



■ reg (register display /modification). 

■ m (memory display/modification) commands that access 
target system memory. 

■ io (I/O display/modification). 

The following command will disable the restriction to real-time runs 
and allow the system to accept commands normally. 

R> cf rrt=dis 



Setting Up tO Break The analyzer may generate a break request to the emulation processor. 
On an Analyzer To set up to break on an analyzer trigger, follow the steps below. 

Trigger 
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Specify the Signal Driven when Trigger is Found 

Use the tgout (trigger output) command to specify which signal is 
driven when the analyzer triggers. Either the "trigl" or the "trig2" 
signal can be driven on the trigger. 

R> tgout trigl 

Enable the Break Condition 

Enable the "trigl " break condition. 
R> be -e trigl 

After you specify the trigger to drive "trigl" and enable the "trigl" 
break condition, set up the trace, issue the t (trace) command, and run 
the program. 

Making Coordinated Coordinated measurements are measurements made between multiple 
Measurements HP 64700 Series emulators which communicate via the Coordinated 

Measurement Bus (CMB). Coordinated measurements can also include 
other instruments which communicate via the BNC connector. A 
trigger signal from the CMB or BNC can break emulator execution into 
the monitor, or it can arm the analyzer. An analyzer can send a signal 
out on the CMB or BNC when it is triggered. The emulator can send an 
EXECUTE signal out on the CMB when you enter the x (execute) 
command. 

Coordinated measurements can be used to start or stop multiple 
emulators, start multiple trace measurements, or to arm multiple 
analyzers. 

As with the analyzer generated break, breaks to the monitor on CMB or 
BNC trigger signals are interpreted as a "request to break". The 
emulator looks at the state of the CMB READY (active high) line to 
determine if it should break. It does not interact with the EXECUTE 
(active low) or TRIGGER (active low) signals. 

For information on how to make coordinated measurements, refer to 
the HP 64700 Emulators Terminal Interface: Coordinated 
Measurement Bus User's Guide manual. 
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Analyzer Topics 



Analyzer StatUS The follwing are the analyzer status labels which may be used in the 
Qualifiers anc ^ "tsto" analyzer commands. 



Oualif ier 


Status bits 


Description 


bg 


OxxxxxxxxxxxxxxxxOxy 


background 


cpu 


OxOOOOxxOlxxxlxxxxy 


cpu cycle 


dma 


OxxOOOOxxllxxxlxxxxy 


DMA memory access 


exec 


OxxxxO lxxxxxxxxxxxxy 


execute instruction 


fetch 


OxxOOOOxxlOxxxlxxxxy 


program fetch 


fg 


Oxxxxxxxxxxxxxxxxlxy 


foreground 


grd 


OxxxxO OxxxxxxxlxOxxy 


guarded memory access 


halt 


Oxxllxxxxxxxxxlxxxxy 


halt 


hold 


OxxxxxxxxxxxxxOxxxxy 


hold acknowledge 


int 


Oxxxxl Oxxxxxxxxxxxxy 


interrupt acknowledge 


io 


OxxOOOOxxOlxOOlxxxxy 


I/O access 


mem 


OxlOOOOxxxxxxxlxxxxy 


memory access 


memio 


OxxOOOOOlllxxxlxxxxy 


memory to io 


memsf r 


OxxOOOOOOllxxxlxxxxy 


memory to sfr 


ms 


OlxOOOOxxOlxxxlxxxxy 


macro service 


read 


OxxOOOOxxxlOxxlxxxxy 


read 


refresh 


OxxOOOOxxOOlxxlxxxxy 


refresh cycle 


sfr 


OxxOOOOxxOlxlllxxxxy 


sfr access 


stop 


OxxlOxxxxxxxxxlxxxxy 


stop 


write 


OxxOOOOxxxllxxlxxxxy 


write 


wrrom 


OxxxxO OxxxxxxxlOxxxy 


write to rom 



The analyzer captures the data of the 70433 microprocessor. When you 
specify a data in the analyzer trigger condition or store condition, the 
ways of analyzer data specifications differ according to the data size. 



To trigger the analyzer when the 70744 microprocessor accesses the 
word data 1234H at address 1000H in 8bit data bus size, the data bus 
activity of the cycles will be as follows. 

Data bus 



In this case, you need to use the analyzer sequential trigger capabilites. 
We do not describe the detail about the sequential trigger feature. Only 
how to trigger the analyzer at this example is described. To specify the 
condition of sequencer level 1, enter: 

M> tif 1 addr=1000 and data=0xx34 



Specifying Data for 
Trigger Condition or 
Store Condition 



Sequencer level Address bus 

1 1000H xx34 

2 1001H xxl2 
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To specify the condition of sequencer level 2, enter: 

M> tif 2 addr=1001 and data=0xx12 

To restart sequencer when any states except for "exec" status are 
generated between sequencer term 1 and 2. 

M> telif stat!=exec 



The monitor is a program which is executed by the emulation 
processor. It allows the emulation system controller to access target 
system resources. For example, when you enter a command that 
requires access to target system resources (display target memory, for 
example), the system controller writes a command code to a 
communications area and breaks the execution of the emulation 
processor into the monitor. The monitor program then reads the 
command from the communications area and executes the processor 
instructions which access the target system. After the monitor has 
performed its task, execution returns to the target program. 

The background monitor does not take up any processor address space 
and does not need to be linked to the target program. The monitor 
resides in dedicated background memory. 

Background Monitor When the emulator is powered up or initialized, the background 

monitor is selected by default. 

Foreground monitor The default emulator configuration selects the background monitor. 

You can change the emulator configuration to select the foreground 
monitor. When you select the foreground monitor, processor address 
space is taken up. The foreground monitor takes up 2K bytes of 
memory. Use the cf command to select the foreground monitor. 

R> cf mon=fg..1000 

1000 defines an hexadecimal address (on a 2K byte boundary) where 
the monitor will be located. (Note: this will not load the monitor, it 
only specifies its location.) The start address of the foreground monitor 



Monitor Option 
Topics 
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must be 2k boundary and between 800H and 0FF000H. The foreground 
monitor must then be loaded into emulation memory. A memory 
mapper term is automatically created when you execute the cf mon=fg 
command to reserve 2K bytes of memory space for the monitor. The 
memory map is reset any time cf mon=bg is entered. It is only reset 
when the cf mon=bg command is entered if the emulator is not already 
configured to use the background monitor. Refer to the "Using the 
Optional Foreground Monitor" appendix. 



Note MSi The foreground monitor provided with 64768 emulator should not be 

1^ located at a base address 0 or Off 800 hex; because the 70433 

microprocessor's vector table or SFR are located respectively. 



Note 




You must not use the foreground monitor if you wish to perform 
coordinated measurements. 



Other Topics This section describes how other emulation tasks, which did not fit into 

the previous groupings, are performed. 

Accessing Internal When you access internal RAM , you can use the m command with 

RAM/SFR function code and the reg command. If you display/modify register in 
the current register bank, you must use reg command instead of the m 
command. Otherwise you will destroy the monitor program. 

When you access SFR(Special Function Registers), you must use the 
reg command with their register name instead of the m command. You 
can access SFR regardless of memory mapping. 
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Notes 
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In-Circuit Emulation Topics 



Introduction Many of the topics described in this chapter involve the commands 

which relate to using the emulator in-circuit, that is, connected to a 
target system. 

This chapter will: 

■ Describe the issues concerning the installation of the emulator 
probe into target systems. 

■ Show you how to install the emulator probe. 

■ Describe how to set up the emulator to use a target system 
clock, how to execute program from target reset and how to 
allow DMA accesses to emulation memory. These topics are 
related to program execution in general. 

■ Describe how to use software breakpoints with ROMed code, 
how to perform coverage testing on ROMed code, and how to 
test patches to ROMed code. These topics relate to the 
debugging of target system ROM. 

■ Describe some of restrictions and considerations. 



Pr6r6qU isiteS Before performing the tasks described in this chapter, you should be 

familiar with how the emulator operates in general. Refer to the 
Concepts of Emulation and Analysis manual and the "Getting Started" 
chapter of this manual. 
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Installing the 
Emulator Probe 
into a Target 
System 



The 64768 emulator probe has a 132-pin PGA connector; 
The emulator probe is also provided with a conductive pin protector to 
protect the delicate gold-plated pins of the probe connector from 
damage due to impact. Since the protector is non-conductive, you may 
run performance verification with no adverse effects when the emulator 
is out-of-circuit. 



Caution H Protect against static discharge. The emulator probe contains devices 

that are susceptible to damage by static discharge. Therefore, 
precautionary measures should be taken before handling the 
microprocessor connector attached to the end of the probe cable to 
avoid damaging the internal components of the probe by static 
electricity. 



Caution 




Make sure target system power is OFF. Do not install the emulator 



probe into the target system microprocessor socket with power applied 
to the target system. The emulator may be damaged if target system 
power is not removed before probe installation. 



Caution Ml Make sure pin 1 of probe connector is aligned with pin 1 of the 

socket. When installing the emulation probe, be sure that probe is 
inserted into the processor socket so that pin 1 of the connector aligns 
with pin 1 of the socket. Damage to the emulator probe will result if the 
probe is incorrectly installed. 
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Caution Protect your target system CMOS components. If you target system 

contains any CMOS components, turn ON the target system first, then 
turn ON the emulator. Likewise, turn OFF your emulator first, then turn 
OFF the target system. 



Pin Protector The target system probe has a pin protector that prevents damage to the 
prove when inserting and removing the probe from the target system 
microprocessor socket. Do not use the probe without a pin protector 
installed. If the target system probe is installed on a densely populated 
circuit board, there may not be enough room to accommodate the 
plastic shoulders of the probe socket. If this occurs, another pin 
protector may be stacked onto the existing pin protector. 



Conductive Pin Guard hp emulators are shipped with a conductive plastic or conductive foam 

pin guard over the target system probe pins. This guard is designed to 
prevent impact damage to the pins and should be left in place while you 
are not using the emulator. However, when you do use the emulator, 
either for normal emulation tasks, or to run performance verification on 
the emulator, you must remove this conductive pin guard to avoid 
intermittent failures due to the target system probe lines being shorted 
together. 



« 



Caution Jfc Always use the pin protectors and guards as described above. 

Failure to use these devices may result in damage to the target system 
probe pins. Replacing the target system probe is expensive; the entire 
probe and cable assembly must be replaced because of the wiring 
technology employed. 
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Installing intO a PGA To connect the microprocessor connector to the target system, 
Type Socket proceeded with the following instructions. 



Remove the 70433 microprocessor (PGA type) from the target 
system socket. Note the location of pin Al on the 
microprocessor and on the target system socket. 

Store the microprocessor in a protected environment (such as 
antistatic form). 

Install the microprocessor connector into the target system 
microprocessor socket. 



Caution ^§ DO NOT use the microprocessor connector without using a pin 

protector. The pin protector is provided to prevent damage to the 



microprocessor connector when connecting and removing the 
microprocessor connector from the target system PGA socket. 



Installing intO a QFP To connect the 64768 emulator microprocessor connector to the NEC 
Type Socket EV-9200GD-120 socket on the target system, use the NEC 
EV-9501GD-120 adapter. 
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MICROPROCESSOR 
CONNECTOR 



TERCET SYSTEM 

MICROPROCESSOR 

SOCKET 




SOCKET 



Figure 4-1 Installing into a 70433 PGA type socket 
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Execution Topics 



The descriptions in this section are of emulation tasks which involve 
program execution in general. 



Specifying the 
Emulator Clock 
Source 



The default 64768 emulator configuration selects the internal 12.5MHz 
(system clock speed) clock as the emulator clock source. You should 
configure the 64768 emulator to select an external target system clock 
source for the "in-circuit" emulation. Use the cf (configuration) 
command and the elk configuration item to specify that the emulator 
use a target system clock. 

R> cf clk=ext 

To reconfigure the emulator to use its internal clock, enter the 
following command. 

R> cf clk=int 



DMA Cycles Cycles from the emulation processor's internal DMA controller is 
allowed to access emulation memory. If DMA controller is 
programmed to transfer with BURST or DEMAND RELEASE mode, 
the emulator can not break in monitor until transfers are 
completed. With other DMA modes, the emulator break into the 
monitor(background) upon request, however, DMA transfers are 
continued. DMA cycles are sent to the analyzer. 



Note 




Target system DMA controller access to emulation memory is not 
allowed. Only internal DMA controller can access emulation memory. 



Run from Target You can use "r rst" command to execute program from target system 
System Reset reset. If you use background monitor, you will see T> system prompt 
when you enter "r rst". In this status, the emulator accept target system 
reset. Then program stars if reset signal from target system is released. 

If you use foreground monitor, reset signal from target system is 
always accepted. 
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Note SI ^ n me "Awaiting target reset" status(T>), you can not break into the 

monitor. If you enter "r rst" in out-of-circuit or in the configuration that 
emulator does not accepted target system reset(cf rst=dis), you must 
reset the emulator. 



The 64768 emulator supports power on reset. If you want program to 
be executed by power on reset, execute the following process. 

1) Enter "rst" 

2) Turn OFF your target system 

3) Enter "r rst" 

4) Turn On your target system 



4 



Note ££§ When you enter "r rst", you will see c> system prompt if you use 

external clock(cf clk=ext). This status is the same as "Awaiting target 
reset" status. 



Emulator Probe The descriptions in this section are of emulation tasks which involve 



Signal Topics 



emulator probe signals while in background or while accessing 
emulation memory. 



Allowing the Target High-speed emulation memory provides no-wait-state operation. 
System tO Insert Wait However, the emulator may optionally respond to the target system 
States rea dy while emulation memory is being accessed. Use the cf 
(configuration) command with the rdy configuration item to cause 
emulation memory accesses to honor target system ready signals. 

R> cf rdy=lk 
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To reconfigure so that emulation memory accesses do not honor target 
system ready signals, enter the following command. 

R> cf rdy=unlk 

Accepti ng the DMA Even if the emulator is running in the background monitor, DMARQO, 
Request Signals from DMARQ1 signals from target system can be accepted. 

Target System 



Note 




Frequent DMA requests will slow down the monitor operation. It may 
cause a failure. 



Target ROM 
Debug Topics 



The descriptions in this section are of emulation tasks which involve 
debugging target ROM. The tasks described below are made possible 
by the cim (copy target system memory image) command. 

The cim command allows you to read the contents of target memory 
into the corresponding emulation memory locations. Moving target 
ROM contents into emulation memory is the key which allows you to 
perform the tasks described below. For example, if target ROM exists 
at locations 400H through 0A38H, you can copy target ROM into 
emulation memory with the following commands. 

R> map 400..0bff erom 

R>cim 400..0a38 



Using Software 
Breakpoints with 
ROMed Code 



You cannot define software breakpoints in target ROM memory. 
However, you can copy target ROM into emulation memory which 
does allow you to use software breakpoints. 

Once target ROM is copied into emulation memory, software 
breakpoints may be used normally at addresses in these emulation 
memory locations. 

R> be -e bp 
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R> bp 440 



Coverage Testing Coverage testing (as described in the "Getting Started" chapter) can 
ROMed Code onr y ^ e performed on emulation memory. However, if you wish to 
perform coverage tests on code in target system ROM, you can copy 
target ROM into emulation memory and perform the coverage tests on 
your ROMed code. 

Once target ROM is copied into emulation memory, coverage testing 
may be done normally at addresses in these emulation memory 
locations. 

U> cov -a 400..0a38 



Modifying ROMed Suppose that, while debugging your target system, you begin to suspect 
Code a b u S m some target ROM code. You might want to fix or "patch" this 
code before programming new ROMs. This can also be done by 
copying target system ROM into emulation memory with the cim 
(copy target memory image) command. Once the contents of target 
ROM are copied into emulation memory, you can modify emulation 
memory to "patch" your suspected code. 
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Pin State in 
Background 



While the emulator is running in the background monitor, probe pins 
are in the following state. 



Address Bus 
Data Bus 



ASTB 



DEX 



WRL.WRH 



RD 



Same as foreground 

Always high impedance otherwise you direct the 
emulator to access target memory. When accessing 
target memory, I/O by background monitor, same 
as foreground. 

Same as foreground. 

Same as foreground 

Always high level, except accessing target memory, 
I/O by background monitor. 

Same as foreground except for emulation memory 
write. When accessing emulation memory, low. 



Other 



Same as foreground 
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Electrical The AC characteristics of the HP 64768A/B emulators are listed in the 

Characteristics foUowing table 



Table 4-1 AC Electrical Specifications 



Characteristic 


Symbol 


UPD70433 
12.5MHz 


HP 64768A 


Unit 


Worst Case 


Typical 

(*l) 


Min 


Max 


Min 


Max 


CLKOUT Low to Address Valid 


tDKA 


5 


30 


1 


39 


16.8 


ns 


CLKOUT High to Address Invalid 


tHKA 


5 




1 




16.8 


ns 


CLKOUT High to Address-Data Bus High 
Impedance 


tFKT 




40 




43 


6.3 


ns 


Address Valid to ASTB Asserted 


tSAST 


15 




5 




36.0 


ns 


ASTB Asserted to Address Invalid 


tHSTA 


25 




17 




30.4 


ns 


CLKOUT Low to ASTB Negated 


tDKSTL 


0 


25 


-4 


32 


7.6 


ns 


CLKOUT Low to ASTB Negated 


tDKSTH 


0 


25 


-4 


32 


6.0 


ns 


ASTB Width High 


tWSTH 


65 




60 




79.6 


ns 


CLKOUT High to RD Asserted(Read) 


tDKRL 


0 


25 


-1 


42 


26.4 


ns 


CLKOUT High to RD Negated(Read) 


tDKRH 


0 


25 


-1 


40 


15.6 


ns 


RD Width Low (Read) 


tWRL 


105 




100 




112.4 


ns 


Address-Data Bus High Impedance to RD 
Asserted(Read) 


tFARL 


0 




-21 




18.1 


ns 


RD Negated to Address Valid(Read) 


tDRA 


40 




4 




30.4 


ns 
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Table 4-1 AC Electrical Specification(Cont'd) 



Characteristic 


Symbol 


UPD70433 
12.5MHz 


HP 64768A 


Unit 


Worst Case 


Typical 

(*1) 


Min 


Max 


Min 


Max 


CLKOUT Low to DEX Asserted,Negated 


tDKDX 


0 


30 


-4 


39 


- 


ns 


CLKOUT Low to DEX Asserted,Negated 


tHKDX 


0 




-4 




- 


ns 


CLKOUT Low to Data-in Valid 


tSDK 


15 




33 




21.0 


ns 


CLKOUT Low to Data-in Invalid 


tHKDR 


0 








0 


ns 


CLKOUT Low to WR Asserted(Write) 


tDKWL 


0 


25 


-1 


42 


18.4 


ns 


CLKOUT Low to WR Negated(Write) 


tDKWH 


0 


25 


-1 


40 


14.4 


ns 


WR Width Low (Write) 


tWWL 


65 




60 




72.8 


ns 


CLKOUT High to Data-out Valid(Write) 


tDKD 


3 


30 


-1 


39 


14.4 


ns 


CLKOUT Low to Data-out Invalid(Write) 


tHKDW 


0 




-4 




14.8 


ns 


WR Negated to ASTB Negated(Write) 


tDWSTH 


0 




-15 




-7.6 


ns 


CLKOUT High to RAS Asserted 


tDKRAL 


0 


25 


-4 


34 




ns 


CLKOUT High to RAS Negated 


tDKRAH 


0 


25 


-4 


29 




ns 


RAS Width High 


tWRAH 


65 




63 






ns 


WR Asserted to RAS Negated 


tSWRA 


30 




10 






ns 
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Table 4-1 AC Electrical Specification(Cont'd) 



Characteristic 


Symbol 


UPD70433 
12.5MHz 


HP 64768A 


Unit 


Worst Case 


Typical 

(*1) 


Min 


Max 


Min 


Max 


READY Asserted Input Setup Time 


tSRYHK 


18 




41 




30.0 


ns 


READY Asserted Input Hold Time 


tHKRYL 


15 








15 


ns 


READY Negated Input Setup Time 


tSRYLK 


18 




41 




30.0 


ns 


READY Negated input Hold Time 


tHKRYH 


15 








15 


ns 


RESET Width Low (Stop/PWR on RST) 


tWRSLl 


30 








^0 
JU 


ms 


RESET Width Low (System Reset) 


L VYROLZ 


5 










us 


NMI Width High 


tWKTTW 


5 








5 


us 


NMI Width Low 


tWNIL 


5 








5 


us 


POLL Setup Time 


tSPLK 


30 




43 






ns 


HLDREQ Setup Time 


tSHQK 


30 




70 






ns 


CLKOUT Low to HLDACWR Asserted 


tDKHA 


0 


30 


-4 


39 




ns 


HLDAK Asserted to Bus Control (*2) High 
Impedance 


tFCHA 


0 




-3 






ns 


HLDAK Negated to Bus Control (*2) Driven 


tDHAC 


40 




42 






ns 


HLDREQ Negated to HLDAC Negated 


tDHQHA 




280 




326 




ns 
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Table 4-1 AC Electrical Specification(Cont'd) 



Characteristic 


Symbol 


UPD70433 
12.5MHz 


HP 64768A 


Unit 


Worst Case 


Typical 

(*1) 


Min 


Max 


Min 


Max 


HLDREQ Negated to Bus control (*2) Driven 


tDHQC 


90 




87 




- 


ns 


HLDREQ Width Low 


tWHQL 


160 




155 




- 


ns 


HLDAK Width Low 


tWHAL 


240 




235 




- 


ns 


CLKOUT Low to BUSLOCK Asserted 


tDKBL 


2 


25 


-2 


34 




ns 


RDJORD Negated to ASTB Negated 


tDRST 


0 




-15 






ns 


WRJOWR Negated to RDJORD Negated 


tDWR 


0 




-12 






ns 


CLKOUT High to DMAAKm Asserted 


tDKDA 


0 


30 


-4 


39 




ns 


DMAAKm Width Low 


tWDAL 


230 




220 






ns 


CLKOUT High to TCEm Asserted 


tDKTE 


0 


30 


-4 


39 




ns 


TCEm Width Low 


tWTCL 


70 




60 






ns 


WDTOUT Width low 


tWWTL 


2550 








2550 


ns 



*1 Typical outputs measured with 50pF load 

*2 ASTB, RD, WRH, WRL, DEX, RAS , BUSLOCK, IORD, IOWR, ADO-AD 1 5 , Al 6-A2 3 
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Table 4-2 AC Electrical Specifications 



Characteristic 


Symbol 


UPD70433 
16MHz 


HP 64768B 


Unit 


Worst Case 


Typical 

(*1) 


1V11I1 


IVlctX 


1V11I1 


lVf QV 


CLKOUT Low to Address Valid 


1 1 AIZ A 

L l Jix/A 


5 


27 


1 


36 


1 (\ A 


ns 


CLKOUT High to Address Invalid 


L rlJvA 


0 




-4 




1 (\ A 


ns 


CLKOUT High to Address-Data Bus High 
Impedance 


L rJvl 




36 




39 


O.J 


ns 


Address Valid to ASTB Asserted 


tSAST 


6 




-4 




36.0 


ns 


ASTB Asserted to Address Invalid 


tHSTA 


16 




8 




1 Q 8 
1 y.o 


ns 


CLKOUT Low to ASTB Negated 


lujvo i r 


0 


22 


-4 


29 


12.8 


ns 


CLKOUT Low to ASTB Negated 


tDKSTH 


0 


22 


-4 


29 


9.6 


ns 


ASTB Width High 


tWSTH 


47 




42 




62.0 


ns 


CLKOUT High to RD Asserted(Read) 


tDKRL 


0 


22 


-1 


39 


26.8 


ns 


CLKOUT High to RD Negated(Read) 


tDKRH 


0 


22 


-1 


37 


15.2 


ns 


RD Width Low (Read) 


tWRL 


78 




73 




84.0 


ns 


Address-Data Bus High Impedance to RD 
Asserted(Read) 


tFARL 


0 




-21 




18.5 


ns 


RD Negated to Address Valid(Read) 


tDRA 


31 




-2 




36.4 


ns 
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Table 4-2 AC Electrical Specification(Cont'd) 



Characteristic 


Symbol 


UPD70433 
16MHz 


HP 64768B 


Unit 


Worst Case 


Typical 

(*1) 


Min 


Max 


Min 


Max 


CLKOUT Low to DEX Asserted,Negated 


tDKDX 


0 


27 


-4 


36 


- 


ns 


CLKOUT Low to DEX Asserted,Negated 


tHKDX 


0 




-4 




- 


ns 


CLKOUT Low to Data-in Valid 


tSDK 


11 




32 




- 


ns 


CLKOUT Low to Data-in Invalid 


tHKDR 


0 




0 




- 


ns 


CLKOUT Low to WR Asserted(Write) 


tDKWL 


0 


22 


-1 


39 


18.8 


ns 


CLKOUT Low to WR Negated(Write) 


tDKWH 


0 


22 


-1 


37 


12.8 


ns 


WR Width Low (Write) 


tWWL 


50 




45 




51.2 


ns 


CLKOUT High to Data-out Valid(Write) 


tDKD 


3 


27 


-1 


36 


26.8 


ns 


CLKOUT Low to Data-out Invalid(Write) 


tHKDW 


0 




-4 




10.8 


ns 


WR Negated to ASTB Negated(Write) 


tDWSTH 


0 




-15 




-7.2 


ns 


CLKOUT High to RAS Asserted 


tDKRAL 


0 


22 


-4 


31 




ns 


CLKOUT High to RAS Negated 


tDKRAH 


0 


22 


-4 


26 




ns 


RAS Width High 


tWRAH 


47 




45 






ns 
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Table 4-2 AC Electrical Specification(Cont'd) 



Characteristic 


Symbol 


UPD70433 
16MHz 


HP 64768B 


Unit 


Worst Case 


Typical 

(*1) 


Min 


Max 


Min 


Max 


READY Asserted Input Setup Time 


tSRYHK 


18 




41 




30.0 


ns 


READY Asserted Input Hold Time 


tHKRYL 


12 




12 




- 


ns 


READY Negated Input Setup Time 


tSRYLK 


18 




41 




30.0 


ns 


READY Negated input Hold Time 


tHKRYH 


12 




12 




- 


ns 


RESET Width Low (Stop/PWR on RST) 


tWRSLl 


30 




30 






ms 


RESET Width Low (System Reset) 


L VYROLZ 


1 




1 






us 


NMI Width High 


tWKTTW 


5 




5 






us 


NMI Width Low 


tWNIL 


5 




5 






us 


POLL Setup Time 


tSPLK 


25 




38 






ns 


HLDREQ Setup Time 


tSHQK 


25 




65 






ns 


CLKOUT Low to HLDACWR Asserted 


tDKHA 


0 


27 


-4 


36 




ns 


HLDAK Asserted to Bus Control (*2) High 
Impedance 


tFCHA 


0 




-3 






ns 


HLDAK Negated to Bus Control (*2) Driven 


tDHAC 


39 




41 






ns 


HLDREQ Negated to HLDAC Negated 


tDHQHA 




252 




298 




ns 
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Table 4-2 AC Electrical Specification(Cont'd) 



Characteristic 


Symbol 


UPD70433 
16MHz 


HP 64768B 


Unit 


Worst Case 


Typical 

(*1) 


Min 


Max 


Min 


Max 


HLDREQ Negated to Bus control (*2) Driven 


tDHQC 


76 




73 




- 


ns 


HLDREQ Width Low 


tWHQL 


124 




119 




- 


ns 


HLDAK Width Low 


tWHAL 


176 




171 




- 


ns 


CLKOUT Low to BUSLOCK Asserted 


tDKBL 


0 


27 


-4 


36 




ns 


RDJORD Negated to ASTB Negated 


tDRSTH 


0 




-15 






ns 


WRJOWR Negated to RDJORD Negated 


tDWRH 


0 




-15 






ns 


CLKOUT High to DMAAKm Asserted 


tDKDA 


0 


27 


-4 


36 




ns 


DMAAKm Width Low 


tWDAL 


176 




166 






ns 


CLKOUT High to TCEm Asserted 


tDKTE 


0 


27 


-4 


36 




ns 


TCEm Width Low 


tWTCL 


52 




42 






ns 


WDTOUT Width low 


tWWTL 


1974 










ns 



*1 Typical outputs measured with 50pF load 

*2 ASTB, RD, WRH, WRL, DEX, RAS , BUSLOCK, IORD, IOWR, ADO-AD 1 5 , Al 6-A2 3 
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Pl(0:6) 
HLDRQ 



These signals are connected to 74ACT14 
through 51 ohm series register and 100K ohm 
pull-down register. 



P1C0:6) 
HLDRO 



P6(0:3) 



These signals are connected to 64768 emulation 
processor and FET Switch through IK ohm 
register. 



P0(0:7) P2(0:5) 
P3(0:6) P4(0:7) 
P5(0:2) P7(0:7) 
P8(0:l) 



These signals are connected to 64768 emulation 
processor through 51 ohm register and 10K 
ohm pull-up register. 



P0(0:7) P2(0:5) 

P3(0:G) P4(0:7) 

P5(0:2) P7(0:7) 
P8 ( 0 : 1 ) 



: 



<> 10K 
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RESET 



This signal is connected to 74ACT14 through 
5 1 ohm register and 10K ohm pull-up register. 



+5V 



RESET 



A/W 



74RCT14 



Other signals These signals are connected to 74FCT245 or 

74FCT244 through 51 ohm register and 10K 
ohm pull-up register. 
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A 



64768 Emulator Specific Command Syntax 



The following pages contain descriptions of command syntax specific 
to the HP 64768 emulator. The following syntax items are included 
(several items are part of other command syntax): 

■ <ACCESS_MODE>. May be specified in the mo (display 
and access mode), m (memory), and io (I/O port) commands. 
The access mode is used when the m or io commands modify 
target memory or I/O locations. 

■ <ADDRESS>. May be specified in emulation commands 
which allow addresses to be entered. 

■ <CONFIG_ITEMS>. May be specified in the cf (emulator 
configuration) and help cf commands. 

■ <DISPLAY_MODE>. May be specified in the mo (display 
and access mode), m (memory), io (I/O port), and ser (search 
memory for data) commands. The display mode is used when 
memory locations are displayed or modified. 

■ <REG_NAME> and <REG_CLASS>. May be specified in 
the reg (register) command. 
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ACCESS MODE 



Summary Specify cycles used by monitor when accessing target system memory 
or I/O. 

Syntax 



c 





Function The <ACCESS_MODE> specifies the type of microprocessor cycles 
that are used by the monitor program to access target memory or I/O 
locations. When a command requests the monitor to read or write to 
target system memory or I/O, the monitor program will look at the 
access mode setting to determine whether byte or word instructions 
should be used. 

Parameters 

b Byte. Selecting the byte access mode specifies that 

the emulator will access target memory using upper 
and lower byte cycles (one byte at a time). 

w Word. Selecting the word access mode specifies 

that the emulator will access target memory using 
word cycles (one word at a time) at an even address. 
At an odd address, the emulator will access target 
memory using byte cycles. 

Defaults In the HP 64768, the <ACCESS_MODE> is b at power up 

initialization. Access mode specifications are saved; that is, when a 
command changes the access mode, the new access mode becomes the 
current default. 

Related Commands mo (specify display and access modes) 
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ADDRESS 



AddreSS Syntax Address specifications used in emulation commands. 



Syntax 





<SEGMENT> 




\ 




H 





< OFFSET) 






r 





< X0FF5ET > 




) 





► 


<PHY RDDR> 











< IRRM RDDR> 









^ @i r arrT^)- 





(I/O RDDR> 




• ► 





Function The <ADDRESS> parameter used in emulation commands may be 
specified as a logical address, extended logical address, physical 
address(though a physical address in run or step command is converted 
to logical address by the emulation system), function code address. 

Parameters 

<SEGMENT> This expression (0-OFFFF hex) is the segment 

portion of the logical address. The value specified is 
placed in the 70433 PS register before running or 
stepping. 
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<OFFSET> This expression (0-OFFFF hex) is the offset portion 
of the logical address. The value specified is placed 
in the 70433 PC register before running or stepping. 

<XSEGMENT> This expression (0-OFFFF hex) is the segment 
portion of the extended logical address. 

<XOFFSET> This expression (0-OFFFF hex) is the offset portion 
of the extended logical address. 

<PHY_ADDR> This expression (0-OFFFFFF hex) is a physical 

address in the 70433 address range. In run and step 
commands, the only expression (0-OFFFFF hex) is 
permitted, and the emulation system converts this 
physical address to a logical address as specified by 
the rad (run address default) configuration item 
(see the <CONFIG_ITEM> description). 

<IRAM_ADDR> This expression (0-1FF hex) with function code is a 
address in the 70433 internal RAM address range. 
This expression should be used in memory 
command. 

<I/0_ADDR> This expression (0-OFFFF hex) with no function 
code is a address in the 70433 I/O address range. 
This expression should be used in I/O command. 

Defaults If no number base is specified, values entered are interpreted as 
hexadecimal numbers. 

Related Commands <C0NFIG_ITEMS> (70433 specific items specified with thecf 

command) 
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CONFIG ITEMS 



Summary HP 64768 emulator configuration items. 

Syntax 
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Function The <CONFIG_ITEMS> are the HP 64768 specific configuration 
items which can be displayed/modified using the cf (emulator 
configuration) command. If the "=" portion of the syntax is not used, 
the current value of the configuration item is displayed. 



Parameters 

hold Respond to Target Hold . This configuration item 

allows you to specify whether or not the emulator 
accepts hold signal generated by the target system. 

Setting hold equal to dis specifies that the emulator 
ignores hold signal from target system completely. 

Setting hold equal to en specifies that the emulator 
accepts hold signal. When the hold is accepted, the 
emulator will respond as actual microprocessor. 

nmi Enable/disable user NMI. This configuration item 

allows you to specify whether user NMI is accepted 
or ignored by the emulator. 

To accept user NMI, set nmi equal to en. To ignore 
user NMI, set nmi to dis. 



Note Ha When target NMI signal is enabled , it is in effect while the emulator is 
running in the target program. While the emulator is running 
background monitor, NMI will be suspended until the monitor is 
finished. 



rrt Restrict to Real-Time Runs. This configuration 

item allows you to specify whether program 
execution should take place in real-time or whether 
commands should be allowed to cause breaks to the 
monitor during program execution. 

To restrict execution to real-time, set rrt equal to 
en. To allow breaks to the monitor during program 
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execution, set rrt equal to dis. When runs are 
restricted to real-time, commands which access 
target system resources (display registers, 
display/modify target system memory or I/O) are 
not allowed. 

rst Respond to Target Reset. This configuration item 

allows you to specify whether or not the emulator 
respond target system reset while running in user 
program or waiting for target system reset. 

While running in background monitor, the HP 
64768 emulator ignores target system reset 
completely independent on this setting. 

Specifying "cf rst=en", this is a default 
configuration, make the emulator to respond to reset 
from target system. In this configuration, emulator 
will accept reset and execute from reset vector in 
the same manner as actual microprocessor after 
reset is inactivated. 

You can ignore reset from target system completely 
by specifying "cf rst=dis". In this configuration 
emulator ignore reset from target system. 



When you use the r rst (run from reset) command in-circuit to run 
form processor reset after the target reset input, you must use "cf 
rst=en" configuration setting. 
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tdma Trace Internal DMA cycles. This configuration 

item allows you to specify whether or not the 
analyzer trace the HP 64768 emulation processor's 
internal DMA cycles. 



Setting tdma equal to en specifies that the analyzer 
will trace the HP 64768 internal DMA cycles. 



Setting tdma equal to dis specifies that the analyzer 
will not trace the HP 64768 internal DMA cycles. 



elk Clock Source. This configuration item allows you 

to specify whether the emulator clock source is to 
be internal (int, provided by the emulator) or 
external (ext, provided by the target system). 



In the HP 64768A/B emulators, the internal clock 
speed is 12.5 MHz (system clock). 

The HP 64768A emulator will operate at external 
clock speed from 4 to 25 MHz (entered clock). 

The HP 64768B emulator will operate at external 
clock speed from 4 to 32 MHz (entered clock). 

The HP 64768 emulator is reset often after 
specifying this configuration item. 



dsize Data Bus size. This configuration item allows you 

to specify whether the data bus size is to be 8(8,data 
bus size is 8 bits) or 16(16,data bus size is 16 bits). 



The HP 64768 emulator is reset state after 
specifying this configuration item. 
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The HP 64768 emulator operates in accordance with this configuration 
instead of D8/16 signal from target system. D8/16 signal from target 
system is ignored. 



mne Type of Mnemonic. This configuration item allows 

you to specify the type of mnemonic that are used 
by display memory and display trace command. 

Setting mne equal to 70433 specifies that emulator 
will display memory in uPD70433 mnemonic. 

Setting mne equal to 8086 specifies that emulator 
will display memory in iAPX86/l 0(8086) 
mnemonic. 



The instruction that is not included iAPX86/10 mnemonic is displayed 
with uPD70433 mnemonic, even if you specify mne=8086. 



mon Monitor Options. This configuration item is used to 

select the type of monitor to be used by the 
emulator. 

If bg (background monitor) is selected, all monitor 
functions are performed in background. 
If fg (foreground monitor) is selected, all monitor 
functions are performed in foreground. You should 
use the 20 bits physical address expression to locate 
the foreground monitor on a 2K byte boundary 

The HP 64768 emulator is reset after specifying this 
configuration item. 
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4 



Note SI ^he start address of the foreground monitor should not be located at a 

base address 0 or 0ff800 hex;because the 70433 microprocessor's 
vector table or SFR are located respectively. Refer to the "Using the 
Optional Foreground Monitor" appendix in this manual. 



rad Physical to Logical Run Address Conversion. This 

configuration item allows you to specify the default 
method in which the emulation system will convert 
physical addresses specified in run and step 
commands to logical addresses. 

Setting rad equal to maxseg specifies that the low 
nibble of the physical address become the offset 
value; the high four nibbles become the segment 
value. 

Setting rad equal to minseg specifies that the low 
four nibbles of the physical address become the 
offset value; the high nibble and three hex zeros 
will become the segment value. 

Setting rad equal to curseg specifies that the value 
which is entered in a run or step command will 
become the offset value. 

rdy Allow Target Ready Signals to Insert Wait States. 

This configuration item allows you to specify 
whether the emulator should honor target system 
ready signals on accesses to emulation memory. 

Setting rdy equal to lk specifies that target ready 
signals be honored on emulation memory accesses. 
Setting rdy equal to unlk specifies that target ready 
signals be ignored on emulation memory accesses. 
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rsp Specify the Stack Location. This configuration item 

allows you to specify the stack location value ; 
(SS:SP) after the emulation reset. The stack 
segment (SS) and stack pointer (SP) will be set on 
entrance to the emulation monitor initiated RESET 
state. 

You should use the logical address expression to 
locate the stack area. 



Note 




When you are using the foreground monitor, this address should be 
defined in an emulation memory or a target system RAM area. 



trfsh Trace Refresh cycles. This configuration item 

allows you to specify whether or not the analyzer 
trace the HP 64768 emulation processor's refresh 
cycles. 



Setting trfsh equal to en specifies that the analyzer 
will trace refresh cycles. 



Setting trfsh equal to dis specifies that the analyzer 
will not trace refresh cycles. 



Defaults The default values of HP 64768 emulator configuration items are listed 
below. 

cf clk=int 

cf dsize=16 

cf hold=en 

cf mne=70433 

cf mon=bg 

cf nmi=en 

cf rad=minseg 

cf rdy=lk 

cf rrt=dis 

cf rsp=0000 : 8000 

cf rst=en 

cf tdma=en 

cf thold=en 

cf trfsh=en 

mo -aw -dw 
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Related Commands You can get an on line help information for particular configuration 

items by typing: 

R> help cf <CONFIG_ITEM> 
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DISPLAY MODE 



Summary Specify the memory display format or the size of memory locations to 
be modified. 



Syntax 



Function The <DISPLAY_MODE> specifies the format of the memory display 
or the size of the memory which gets changed when memory is 
modified. 



Parameters 



b Byte. Memory is displayed in a byte format, and 

when memory locations are modified, bytes are 
changed. 

w Word. Memory is displayed in a word format, and 

when memory locations are modified, words are 
changed. 

d Double-word. Memory is displayed in a 

double-word format, and when memory locations 
are modified, double- words are changed. 

m Mnemonic. Memory is displayed in mnemonic 

format; that is, the contents of memory locations are 
inverse-assembled into mnemonics and operands. 
When memory locations are modified, the last 
non-mnemonic display mode specification is used. 
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You cannot specify this display mode in the ser 
(search memory for data) command. 



Defaults 



Related Commands 



At powerup or after init,in the HP 64768 Emulator, the 
<ACCESS_MODE> and <DISPLAY_MODE> are b. 

Display mode specifications are saved; that is, when a command 
changes the display mode, the new display mode becomes the current 
default. 

mo (specify access and display modes) 

m (memory display/modify) 

io (I/O display/modify) 

ser (search memory for data) 
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REGISTER CLASS 
and NAME 



Summary 70433 register designator. All available register class names and 
register names are listed below. 

<REG_CLASS> 

<REG_NAME> Description 
*(AU basic registers) 

aw, bw BASIC registers. 

cw, dw 

bp, ix, iy 

dsO, dsl, 

ds2, ds3 

ss, sp 

pc, ps, psw 
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port (Port registers) 



pO Port 0 

pi Port 1 (Read Only) 

p2 Port 2 

p3 Port 3 

p4 Port 4 

p5 Port 5 

p6 Port 6 (Read Only) 

p7 Port 7 

p8 Port 8 

pmO Port 0 mode 

pm2 Port 2 mode 

pm3 Port 3 mode 

pm4 Port 4 mode 

pm5 Port 5 mode 

pm7 Port 7 mode 

pm8 Port 8 mode 

pmc2 Port 2 mode control 

pmc3 Port 3 mode control 

pmc4 Port 4 mode control 

pmc5 Port 5 mode control 

pmc7 Port 7 mode control 

pmc8 Port 8 mode control 

prdc Port read control 

rop (Real-time Output port registers) 

rtpc Real-time output port control 

rtpd Real-time output port delay display 

p71 Port 7 buffer(Low) 

p7h Port 7 buffer(high) 

rtp Real-time output port 
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tim (Timer registers) 



tmO Timer 0 

tml Timer 1 

tm2 Timer 2 

tm3 Timer 3 

ctOO Timer capture 00 

ctO 1 Timer c apture 0 1 

ctlO Timer capture 10 

cmOO Timer compare 00 

cmOl Timer compare 01 

cmlO Timer compare 10 

cmll Timer compare 1 1 

cm20 Timer compare 20 

cm21 Timer compare 21 

cm22 Timer compare 22 

cm23 Timer compare 23 

cm30 Timer compare 30 

cm31 Timer compare 3 1 

tmc Timer control 

toe Timer output control 

stc Software timer counter (Read Only) 

stmc Software timer counter compare 

pvvmu (PWM uint registers) 

pwm PWM 

pvvmc PWM control 
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dma (DMA registers) 



UllldlllU 


DMA mode 0 


fl ITl M IT1 1 

tlllllllll A 


DTVTA mode 1 


vl 111 tlv \r 


DMA control 0 


rlrruirl 

11 1 11 tlV. 1 


DTVTA control 1 


tcO 


Terminal counter 0 

L V_- 1 I 1 1 11 1L11 WUlllvl \J 


tcl 


Terminal counter 1 


tcmO 


Terminal counter morlnlo D 


tcml 


Terminal counter modulo 1 


marO 


DMA memory address 0 


marl 


DMA memory address 1 


udcO 


DMA up/down counter 0 


udcl 


DMA up/down counter 1 


dcmO 


DMA compare 0 


dcml 


DMA compare 1 


dptcO 


DMA read/write pointer 0 


dptcl 


DMA read/write pointer 1 


dmas 


DMA status 


pi (Parallel I/F registers) 


pab 


Parallel interface buffer 


pacO 


Parallel interface control 0 


pacl 


Parallel interface control 1 


pas 


Parallel interface status 



pail Parallel interface acknowledge interval 1 

(Write Only) 

pai2 Parallel interface acknowledge interval 2 

(Write Only) 
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ad (Analog-Digital conversion registers) 



adm A/D convenor mode 

adcrO A/D conversion result 0 (Read Only) 

adcrl A/D conversion result 1 (Read Only) 

adcr2 A/D conversion result 2 (Read Only) 

adcr3 A/D conversion result 3 (Read Only) 

uart (UART registers) 

asp Protocol select 

uartmO UART mode 0 

uartml UART mode 1 

uartsO UART status 0 

uartsl UART status 1 

rxbO Receive buffer 0 (Read Only) 

rxbl Receive buffer 1 (Read Only) 

txbO UART transfer buffer 0 (Write Only) 

tx bl UART transfer buffer 1 (Write Only) 

prsO Prescaler 0 

prsl Prescaler 1 

rxbrgO Receive baud rate generator 0 

rxbrgl Receive baud rate generator 1 

txbrgO Transfer baud rate generator 0 

txbrgl Transfer baud rate generator 1 
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csi (Clocked serial I/F registers) 



asp Protocol select 

csimO Clocked serial interface mode 0 

csiml Clocked serial interface mode 1 

sbicO SBI control 0 

rxbO Receive buffer 0 

rxbl Receive buffer 1 

sioO Clocked serial I/O shift 0 (Write Only) 

siol Clocked serial I/O shift 1 (Write Only) 

prsO Receive baud rate generator 0 

prsl Receive baud rate generator 1 

txbrgO Transfer baud rate generator 0 

txbrgl Transfer baud rate generator 1 

proc (Processor status registers) 

stbc Standby control 

pre Processor control 

pwcO Programmable wait control 0 

pwcl Programmable wait control 1 

rfm Refresh mode 

mbc Memory block control 

wdm Watchdog timer mode 
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intc (Interrupt control registers) 



imc Interrupt mode control 

mkO Interrupt mask flag 0 

mkl Interrupt mask flag 1 

ic09 Interrupt request control 09 

iclO Interrupt request control 10 

icll Interrupt request control 1 1 

icl2 Interrupt request control 12 

icl3 Interrupt request control 13 

icl4 Interrupt request control 14 

icl6 Interrupt request control 16 

icl7 Interrupt request control 17 

icl8 Interrupt request control 1 8 

icl9 Interrupt request control 19 

ic20 Interrupt request control 20 

ic21 Interrupt request control 21 

ic22 Interrupt request control 22 

ic23 Interrupt request control 23 

ic24 Interrupt request control 24 

ic25 Interrupt request control 25 

ic26 Interrupt request control 26 

ic27 Interrupt request control 27 

ic28 Interrupt request control 28 

ic29 Interrupt request control 29 

ic30 Interrupt request control 30 

ic31 Interrupt request control 3 1 

ic32 Interrupt request control 32 

ic36 Interrupt request control 36 

ic37 Interrupt request control 37 

i spr In-service priority (Read Only) 

intm External interrupt mode 
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bank<N> (register bank) 



ps_<N> ps of register bank <N> 

pc_<N> pc of register bank <N> 

psw_<N> psw of register bank <N> 

aw_<N> aw of register bank <N> 

bw_<N> bw of register bank <N> 

cw_<N> cw of register bank <N> 

dw_<N> dw of register bank <N> 

sp_<N> sp of register bank <N> 

bp_<N> bp of register bank <N> 

ix_<N> ix of register bank <N> 

iy_<N> iy of register bank <N> 

dsO_<N > dsO of register bank <N> 

dsl_<N> dsl of register bank <N> 

ds2_<N> ds2 of register bank <N> 

vpc_<N> vpc of register bank <N> 

ss_<N> ss of register bank <N> 



Function The <REG_CLASS> names may be used in the reg(register) 
command to display a class of 70433 registers. 

The <REG_NAME> names may be used with the reg command to 
either display or modify the contents of 70433 registers. 

Refer to your 70433 use's manual for complete details on the use of 
70433 registers. 

Related Commands reg (register display/modify) 



A-22 Emulator Specific Command Syntax 



B 



Using the Optional Foreground Monitor 



By using and modifying the optional Foreground Monitor, you can 
provide an emulation environment which is customized to the needs of 
a particular target system. 

The monitor programs named fmon70433.s is to be assembled and 
linked into target program by the HP 64873 Cross Assembler/Linker. 



Comparison of An emulation monitor is required to service certain requests for 

F0T6Q foil nd and information about the target system and the emulation processor. For 

example, when you request a register display, the emulation processor 
Background is forced into the monitor. The monitor code has the processor dump 

Monitors * tS re ^ sters mt0 certa i n emulation memory locations, which can then be 

read by the emulator system controller without further interference. 



Background Monitors A background monitor is an emulation monitor which overlays the 

processor's memory space with a separate memory region. 

Usually, a background monitor is easier to work. The monitor is 
immediately available upon powerup, and you don't have to worry 
about linking in the monitor code or allocating space for the monitor. 
No assumptions are made about the target system environment; 
therefore, you can test and debug hardware before any target system 
code has been written. All of the processor's address space is available 
for target system use, since the monitor memory is overlaid on 
processor memory, rather than subtracted from processor memory. 
Processor resources such as interrupts are not fully taken by the 
background monitor. 
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However, all background monitors sacrifice some level of support for 
the target system. For example, while the emulation processor enters 
the monitor code to display registers, it will not respond to target 
system interrupt requests. This may pose serious problems for 
applications that rely on the microprocessor for real-time, non-intrusive 
support. Also, the background monitor code resides in emulator 
firmware and can't be modified to handle special conditions. 

Foreground Monitors a foreground monitor may be required for more interrupt intensive 

applications. A foreground monitor is a block of code that runs in the 
same memory space as your program. You link this monitor into your 
code so that when control is passed to monitor program, the emulator 
can still service real-time events, such as interrupts or watchdog timers. 
For most multitasking, you will need to use a foreground monitor. You 
can tailor the foreground monitor to meet your needs, such as servicing 
target system interrupts. However, the foreground monitor does use 
part of the processor's address space, which may cause problems in 
some applications. You must also properly configure the emulator to 
use a foreground monitor (see the "Emulation topics" chapter and the 
examples in this appendix). 
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An Example Using 
the Foreground 
Monitor 



In the following example, we will illustrate how to link a foreground 
monitor. By using the emulation analyzer, we will also show how the 
emulator switches from state to state using a foreground monitor. 



For this example, We will locate the monitor at 1000 hex; the sample 
program will be located at 800 hex with its data at 600 hex and its 
common at 400 hex. 



Modify EQU To use the monitor, you must modify the EQU statement near the top 
Statement °f me monitor some code to point to the segment start address where 

the monitor will be loaded. In this example, the monitor will be located 
at 1000 hex, so the modified EQU statement looks like this: 

MONSEGMENT EQU 0100H 

Notice that the EQU statement is indented from the left margin; if it is 
not indented, the assembler will attempt to interpret the EQU as a label 
and will generate an error when processing the address portion of the 
statement. You can load the monitor at any base address on a 2k byte 
boundary. 
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Note |Ei You should not load the foreground monitor at the base address 0 or 

0ff800 hex, because the 70433 microprocessor's vector table and SFR 
are located respectively. 



Assemble and Link 
the Monitor 

$ asv20 -f optimize fmon70433 <RETURN> 

$ Idv20 -o fmon70433.X fmon70433.o <RETURN> 



You can assemble and link the foreground monitor program with the 
following commands by using the HP 64853 Cross Assembler/Linker: 
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Initialize the Emulator 



To initialize the emulator to a known state for this example, type: 



M> init -p 



Configure the You need to tell the emulator that you will be using a foreground 
Emulator monitor and allocate the memory space for the monitor. This is all 

done with one configuration command. To locate the monitor on a 2k 
boundary starting at 1000 hex, type: 

R> cf mon=fg..001000 

To see the new memory mapper term allocated for the foreground 
monitor, type: 

R> map 

# remaining number of terms : 15 

# remaining emulation memory : lf800h bytes 
map 0001000 .. 00017ff eram # term 1 
map other tram 

Notice that a 2k byte block from 1000 through 17ff hex was mapped. 

Now, you need to map memory space for the sample program. Let's 
map the memory from 0 through 4ff hex to emulation RAM and map 
the memory from 600 through 9ff hex to emulation ROM. 

R> map 0..4ff eram 
R> map 600..9ff erom 



Load the Foreground Now it's time to load the sample program and monitor. In the example 
Monitor shown, we're loading the program from a host with the emulator in 
Transparent Configuration. If you're using the standalone 
configuration with a data terminal, you will need to enter the data using 
the m command. (You can get the data from your assembly listings.) 
Load the program by typing: 

R> load -hbs "transfer -tb fmon70433.X" 

############## 
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Load the Sample 
Program 



Assuming the sample program has been assembled and linked as shown 
in "Getting Start" chapter, you can load the sample program by typing: 



##### 

Disable Tracing 
Refresh Cycle 

Set Analyzer Master 
Clock Qualifiers 

tck -r L -u -s S 

M> rst 
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R> load -hbs "transfer -tb cmd rds.X" 



If you wish to disable the analyzer from tracing refresh cycles, you can 
use the cf trfsh command ; the refresh cycles are not detected by the 
analyzer. Type: 

M> cf trfsh=dis 



We want to view the transitions made between the different emulator 
states; reset to break, break to run, run to break. Since the foreground 
monitor is actually entered via a few cycles in the emulator's built-in 
background monitor, we need to be able to view the background states. 
We can do this by modifying the emulation analyzer's master clock 
qualifier to include tracing of background code. To see the initial clock 
qualifier, type: 

M>tck 

Modify this as follows: 

M> tck -r L -ub -s S 

Now, reset the processor so we can make the first measurement from a 
known state: 



Reset to Break We want to see the monitor's transition from the reset state to running 
in the foreground monitor. Since the foreground monitor occupies the 
address range from 1000 through 17ff hex, we can simply trigger on 
any access to that range: 

R> tg addr=1000..17ff 

We also want see the states leading up to the transition between reset 
and foreground monitor execution. We can position the trigger so that 
there are 20 states before the trigger as follows: 

R> tp -b 20 

Start the measurement: 
R>t 

Emulation trace started 

Now, break the emulator into the monitor: 
R>b 

Display 20 disassembled states of the trace from the top the trace: 
M> tl -td 20 



Line addr,H 70433 mnemonic, H 



count, R seq 



-7 


Of f f f2 


0007 


fetch 


BGM 








-6 


000020 


0000 


write mem 


BGM 


1 


920 


uS 


-5 


000022 


ffff 


write mem 


BGM 


1 


920 


uS 


-4 


000024 


f 002 


write mem 


BGM 


1 


920 


uS 


-3 


000008 


0200 


read mem 


BGM 


3 


840 


uS 


-2 


Of f f f 4 


feOl 


fetch 


BGM 


1 


920 


uS 


-1 


00000a 


0100 


read mem 


BGM 


1 


920 


uS 


0 


001200 


a32e 


fetch 


BGM 


2 


880 


uS 


1 


001202 


002c 


fetch 


BGM 


3 


840 


uS 


2 


001200 


MOV PS 


WORD PTR 002c, AW 




0 


320 


uS 


3 


001204 


892e 


fetch 


BGM 


1 


600 


uS 


4 


00102c 


f 080 


write mem 


BGM 


1 


920 


uS 


5 


001206 


2e2e 


fetch 


BGM 


1 


920 


uS 


6 


001204 


MOV PS 


WORD PTR 002e,BP 




0 


320 


uS 


7 


001208 


2e00 


fetch 


BGM 


3 


520 


uS 


8 


00120a 


20al 


fetch 


BGM 


1 


920 


uS 


9 


001209 


MOV AW, 


PS:WORD PTR 0020 




0 


640 


uS 


10 


00102e 


OOfa 


write mem 


BGM 


1 


280 


uS 


11 


00120c 


2e00 


fetch 


BGM 


1 


920 


uS 


12 


001020 


0000 


read mem 


BGM 


3 


840 


uS 



At line -6, the processor began executing code; it executed in the 
background monitor. To see the transition from background execution 
to foreground monitor program execution, type: 
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M> tl 45..65 



Line addr,H 70433 mnemonic, H count, R seq 



45 


001230 


OOal 


fetch 


BGM 


1 


920 


uS 


46 


00122f 


MOV AW, 


PS:WORD PTR 0000 




0 


640 


uS 


47 


001022 


0100 


write mem 


BGM 


1 


280 


uS 


48 


001232 


Of 00 


fetch 


BGM 


3 


840 


uS 


49 


001234 


0427 


fetch 


BGM 


1 


920 


uS 


50 


001000 


0000 


read mem 


BGM 


1 


920 


uS 


51 


001233 


illegal 


opcode, data = Of 27 




0 


320 


uS 


52 


001236 


0000 


fetch 


BGM 


1 


600 


uS 


53 


000024 


f002 


read mem 


BGM 


1 


920 


uS 


54 


000022 


0100 


read mem 


BGM 


3 


840 


uS 


55 


001238 


0400 


fetch 


BGM 


1 


920 


uS 


56 


000020 


0332 


read mem 


BGM 


1 


920 


uS 


57 


001332 


f 62e 


fetch 




2 


880 


uS 


58 


001334 


1906 


fetch 




3 


840 


uS 


59 


001332 


TEST PS 


: BYTE PTR 0019,01 




0 


320 


uS 


60 


001336 


0100 


fetch 




1 


600 


uS 


61 


001338 


c62e 


fetch 




1 


920 


uS 


62 


00133a 


lb06 


fetch 




1 


920 


uS 


63 


001019 


Olxx 


read mem 




1 


920 


uS 


64 


001338 


MOV PS: 


BYTE PTR 001b, 02 




0 


320 


uS 


65 


00133c 


0200 


fetch 




3 


520 


uS 



The foreground monitor start at states 57. 



Monitor to User 
Program 



Emulation trace started 



We can look at the transition from the foreground monitor to running 
the user program by triggering the trace on a user program address. 
Type: 

M> tg addr=800 

We will leave the trigger position where it was for the last 
measurement(20 states are retained before the trigger position). Start 
the measurement: 

M>t 

Now, run the sample program: 
M> r 800 

Display trace states from -15 to +5 in inverse-assembled form as 
follows: 

U>tl-d-15..5 
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Line 


addr , H 


70433 mnemonic, H 


count, R 


_i t 

1 0 


UUlJliJ 


MOV DSO 


,WORD PTR 004 6 


0 


. 320 


uS 


— 1 4 


U U _L -J _L fcr 


2e00 


fetch 


1 


. 600 


uS 


— 1 3 


U U ± D Z U 


06c6 


fetch 


1 


. 920 


uS 


— 1 2 


nni n zi a 


0060 


read mem 


1 


. 920 


uS 


— 1 1 


0 0 1 5 1 f 


MOV PS: 


BYTE PTR 0016,80 


0 


.320 


uS 


— i n 


UUl JZZ 


0016 


fetch 


3 


.520 


uS 


- 9 


nni s 9 4 


cf 80 


fetch 


1 


. 920 


uS 


-8 


001526 


0e8b 


fetch 


1 


. 920 


uS 


-7 


001525 


RET I 




0 


. 320 


uS 


-6 


001016 


xx80 


write mem 


1 


. 600 


uS 


-5 


0004fa 


0800 


read mem 


3 


. 840 


uS 


-4 


001528 


0014 


fetch 


1 


. 920 


uS 


-3 


0004fc 


0000 


read mem 


1 


. 920 


uS 


-2 


00152a 


3e8e 


fetch 


1 


. 920 


uS 


-1 


0004fe 


f046 


read mem 


1 


. 920 


uS 


0 


000800 


60b8 


fetch 


3 


. 840 


uS 


1 


000800 


MOV AW, 


0060 


0 


. 320 


uS 


2 


000802 


8e00 


fetch 


1 


. 600 


uS 


3 


000804 


b8o!8 


fetch 


1 


. 920 


uS 


4 


000803 


MOV DSO, AW 


0 


.320 


uS 


5 


000806 


0040 


fetch 


1 


. 600 


uS 



seq 



At state -7 in the trace listing, the processor executed the RETI 
instruction to transfer execution to the user program at state 0. 
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Note Hsl As you can see in the trace list, user stack pointer is used when context 

is changed from foreground monitor to user program, or from user 
program to foreground monitor program. If you are configuring the 
emulator to background monitor, the user stack is not used. 
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You can trace the execution from the user program run to the 
foreground monitor due to a break condition by setting as follows: 

U> tg stat=bg 

Start the measurement: 
U>t 

Satisfy the trigger condition by break the emulator into the monitor: 
U>b 

Now, display trace states from -10 to +10 in disassembled form as 
follows: 

M> tl -10..10 

Line addr,H 70433 mnemonic, H count, R seq 



10 


00081b 


BE/Z 00 


815 




0 


320 


uS 


-9 


00081e 


7441 


fetch 




1 


600 


uS 


-8 


000815 


2 6xx 


fetch 




1 


920 


uS 


-7 


000816 


OOaO 


fetch 




1 


920 


uS 


-6 


000815 


MOV AL, 


DS 1 : BYTE PTR 0000 




0 


640 


uS 


-5 


000818 


3c00 


fetch 




3 


200 


uS 


-4 


00081a 


7400 


fetch 




1 


920 


uS 


-3 


000400 


xxOO 


read mem 




1 


920 


uS 


-2 


000815 


xxxx 


intack 




0 


320 


uS 


-1 


00081c 


3cf 8 


fetch 




1 


600 


uS 


0 


000020 


0819 


write mem 


BGM 


3 


840 


uS 


1 


000022 


0000 


write mem 


BGM 


1 


920 


uS 


2 


000024 


f046 


write mem 


BGM 


1 


920 


uS 


3 


000008 


0200 


read mem 


BGM 


1 


920 


uS 


4 


00000a 


0100 


read mem 


BGM 


3 


840 


uS 


5 


001200 


a32e 


fetch 


BGM 


2 


880 


uS 


6 


001202 


002c 


fetch 


BGM 


1 


920 


uS 


7 


001200 


MOV PS: 


WORD PTR 002c, AW 




0 


320 


uS 


8 


001204 


892e 


fetch 


BGM 


1 


600 


uS 


9 


00102c 


0000 


write mem 


BGM 


3 


840 


uS 


10 


001206 


2e2e 


fetch 


BGM 


1 


920 


uS 



At state 0 of the trace list, the processor entered the background 
monitor to make the transition. And actual foreground monitor program 
start at after several background monitor execution. To see the starting 
point of foreground monitor, type: 

M> tl 55..75 
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User Program Run to 
Break 



Emulation trace started 



Line 



addr,H 70433 mnemonic, H 



count, R seq 



5 5 


0 01 0 0 0 
U U -L U U U 


0 0 00 


irea-d. mem 


BGM 




92 0 


uS 


5 6 


0 01 2 3 3 

U U -L Z. J J 


illegal 


opcode, data = Of 27 




o 


320 


uS 


5 7 


0 0 0 0 2 4 

U U U U Z. 4 


f 046 


read mem 


BGM 


3 


520 


uS 


5 8 


0 01 2 2 £ 
u u -l z o o 


0000 


fetch 


BGM 




920 


uS 


59 


000022 
u u u u z z 


0100 


read mem 


BGM 




920 


uS 


60 


001238 


0400 


fetch 


BGM 


1 


920 


uS 


61 


000020 


0332 


read mem 


BGM 


1 


920 


uS 


62 


001332 


f 62e 


fetch 




3 


840 


uS 


63 


001334 


1906 


fetch 




1 


920 


uS 


64 


001332 


TEST PS 


: BYTE PTR 0019,01 




0 


320 


uS 


65 


001336 


0100 


fetch 




1 


600 


uS 


66 


001338 


c62e 


fetch 




3 


840 


uS 


67 


001019 


OOxx 


read mem 




2 


560 


uS 


68 


00133a 


lb06 


fetch 




1 


920 


uS 


69 


001338 


MOV P S : 


BYTE PTR 001b, 02 




0 


320 


uS 


70 


00133c 


0200 


fetch 




1 


600 


uS 


71 


00133e 


4475 


fetch 




3 


840 


uS 


72 


00133e 


BNE/Z 01384 




0 


960 


uS 


73 


00101b 


02xx 


write mem 




1 


600 


uS 


74 


001340 


al2e 


fetch 




1 


920 


uS 


75 


001342 


0026 


fetch 




1 


920 


uS 



At state 62, the foreground monitor program starts. 



Single Step and 

Foreground 

Monitors 



To use the "step" command to step through processor instructions with 
the foreground monitor listed in this chapter, you must modify the 
processor's interrupt vector table. The entry that you must modify is 
the "BRK flag" interrupt vector, located at 4H thru 7H. The "BRK 
flag" interrupt vector must point to the " SINGLE_STEP_ENTRY" in 
the foreground monitor. The address of the " SINGLE_STEP_ENTRY" 
is 300H plus the beginning of the foreground monitor. 



Software To use the software breakpoint with the foreground monitor listed in 

Breakpoint and cr,a P ter ' y° u must m °dify tne processor's interrupt vector table. 

" The entry that you must modify is the "BRK 3"interrupt vector, located 

Foreg rOU nd at 0CH thru 0FH. The PC portion of the "BRK 3" interrupt vector must 

Monitors ^ C and the PS portion must be 5678H. 
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Limitations of 

Foreground 

Monitors 



Synchronized 
measurements 



You cannot perform synchronized measurements over the CMB when 
using a foreground monitor. If you need to make such measurements, 
use background monitor. 



Instruction Using 
BRKflag 



If user program includes instruction using the BRK flag(in PSW 
register), you can not use foreground monitor because the foreground 
monitor uses the BRK flag in step command. 



Stepping You can not use step command in the following instruction. 



HALT/STOP 
POP PSW 

BRK 3 /BRK imm8/BRKV 

CHKIND 

FPO 

TSKSW/BRKCS 
RETRBI 



Break from Halt/Stop when the processor is in halt or stop state, the program counter(PC) 
State indicates the next address of HALT or STOP instruction. If you use 
commands which require temporary break(display /modify register,or 
display/modify target system memory or I/O), the program will run 
from the address that PC indicates. 
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Notes 
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symbols 

loading from a text file 2-17 

syntax (command), specific to HP 64768 emulator A-l 

T target reset 

run form reset A-7 
target system 

interface 4-19 
Target system probe 

pin guard 4-2 

target system RAM and ROM 2-12 
target system reset 

run from reset 4-6 

tdma, emulator configuration A-8 

Tektronix hexadecimal files, downloading 2-16 

tg (specify simple trigger) command 2-30 

tgout (trigger output) command 3-6 

tl (trace list) command 2-3 1 

tlb (display/modify trace labels) command 2-29 

tp( specify trigger position) command 2-32 
trace 

even address 2-30 
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2-30 


trace labels, predefined 


2-29 


tram, memory characterization 


2-12 


transfer utility 


2-15 


transparent configuration 


2-14 


transparent mode 


2-16 


trfsh,emulator configuration 


A-11 


trig 1 and trig2 internal signals 


3-6 


trigger 




break on 


3-5 


specifying a simple 


O OA 

2-30 


TRIGGER (CMB signal) 


3-6 


trigger position 


2-32 


trom, memory characterization 


2-12 


ts (trace status) command 


2-30 


unbreak into the monitor 


1-6 


wait states, allowing the target system to insert 


4-7 


warm start initialization 


2-9 


x (execute) command 


3-6 
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